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NOTICE 


The  scientific  conference  described  by  this  report  is  part  of  a 
program  undertaken  under  the  aegis  of  the  National  Academy  of  Sciences 
National  Research  Council  with  the  express  approval  of  the  Governing 
Board  of  the  NRC.  Such  approval  indicated  that  the  Board  considered 
that  the  problem  is  of  national  significance;  thai  ducidation  and/or 
solution  of  the  problem  required  scientific  -  technical  competence  and 
that  the  resources  of  the  NRC  were  particularly  suitable  to  the  conduct 
of  the  project. 

Although  the  reports  of  our  committees  are  not  submitted  for 
approval  to  the  Academy  membership  nor  to  the  Council,  each  report 
is  reviewed  according  to  procedures  established  and  monitored  by  the 
Academy's  Report  Review  Committee.  Distribution  of  the  report  is 
permitted  only  after  satisfactory  completion  of  this  review  process. 

The  present  report  contains  papers  that  were  presented  by 
speakers  invited  to  the  conference  and  represent  their  personal  views 
on  the  subjects  to  which  this  Conference  was  addressed. 
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INTRODUCTORY  REMARKS  -  Professor  D.  L.  Katz,  Chairman 

I  am  Professor  Donald  Katz,  and  welcome  you  today  to  this,  the  eighth 
annual  conference  of  the  Committee  on  Hazardous  Materials. 

* 

It  is  indeed  a  pleasure  to  return  to  Houston.  The  Committee  profited  by  our 
1966  conference  here,  and  we  have  followed  with  much  interest  the  various  f 

developments  in  the  shipment  of  hazardous  materials,  with  the  Houston 
area  always  in  mind. 

For  those  of  you  who  we  have  not  had  the  pleasure  of  meeting  previously, 
a  few  brief  remarks  about  the  background  and  interest  of  our  Committee  may 
be  in  order. 

Since  1964,  The  National  Academy  of  Sciences,  in  response  to  a  request 
from  the  Commandant  of  the  Coast  Guard,  has  studied  scientific  and  technical 
aspects  of  safety  and  public  health  in  the  transportation  of  dangerous 
commodities  by  water.  Among  the  stated  objectives  have  been  the  following: 

(a)  To  define  problem  areas  and  predict  future  conditions  which  affect 
the  lives  and  property  of  operating  personnel  and  the  public. 

(b)  To  advise  on  research  needs,  sponsor  supervised  research  where  the 
specific  expertise  of  the  committee  is  deemed  essential,  and  to 
evaluate  research  findings. 

(c)  To  assist  a  Coast  Guard  special  task  group  to  develop  further  a 

hazard  rating  system  for  bulk  dangerous  cargoes  and  to  assign  * 

suitable  ratings  to  specific  commodities. 

(d)  To  advise  on  standards  of  safety  which  will  adequately  protect  ' 

operating  personnel  and  the  public  without  unnecessary  restiic- 

tions  on  industry. 

These  objectives  have  been  served  by  a  Committee  on  Hazardous 
Materials,  Advisory  to  the  U.  S.  Coast  Guard,  assisted  by  a  full-time 
technical  secretary  on  the  Academy's  staff.  Ihe  present  membership  is 
before  you,  and  we  invite  you  to  meet  with  them  personally.  Many 
additional  scientists  and  engineers  have  participated  in  the  conferences 
and  task  panels  sponsored  by  the  Committee.  The  Committee  itself  has  met 
at  approximately  quarterly  intervals,  one  session  each  year  being  devoted 
to  a  conference  on  a  broad  topic,  to  which  a  number  of  interested  parti¬ 
cipants  have  been  invited.  Our  last  conference  was  held  last  July  at  the 
Coast  Guard  Academy  in  New  London,  Connecticut,  and  considered  in  depth 
the  status  of  chemical  reactivity  and  a  review  of  information  systems. 

Our  objective  today  and  tomorrow  is  an  in  depth  examination  of  systematic 
hazard  analysis  and  risk  evaluation,  as  well  as  a  consideration  of  the  , 

ecological  aspects  of  the  Houston  Ship  Canal,  Galveston  Bay  Area. 

A  word  about  our  approach.  We  are  a  technically  oriented  group,  » 

which  seeks  to  assist  in  problems  by  applying  scientific  and  engineering 
principles.  Our  stated  purpose  is  to  advise  the  Department  of  Transportation, 
and  specifically  the  Coast  Guard,  when  they  ask  our  opinions.  In  tact, 
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Introductory  Remarks  -  continued 

we  also  try  to  anticipate  the  problems  which  will  be  with  us  5  or  10 
years  from  now,  so  constructive  steps  can  be  taken  in  advance. 

We  cordially  invite  your  comments,  input,  and  reactions.  Only  by  a 
full  and  truthful  exchange  of  technical  knowledge  can  we  achieve  our  ob¬ 
jectives  and  properly  discharge  our  responsibilities. 

In  planning  and  arranging  the  many  details  which  are  required  for 
this  conference,  our  technical  secretary,  Mr.  Fawcett,  has  received 
excellent  cooperation  from  many  persons.  We  especially  acknowledge 
Mr.  W.  E.  McConnaughey,  who  is  our  Coast  Guard  Liaison  Officer,  Captain 
W.  E.  West,  Houston  Captain  of  the  Port,  LTJG  Herbert  Hammon,  III,  his 
associate  in  hazardous  materials  and  Captain  D.  F.  Hall,  Officer  in 
Charge  of  Marine  Inspection  of  Houston. 
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Welcome  from  CAPTAIN  W.  E.  WEST,  C.O.T.P. 


Professor  Katz,  Committee  Members  and  guests: 

It  is  with  great  pleasure,  both  personally  and  in  behalf  of  the 
Office  of  Captain  of  the  Port  of  Houston,  that  we  welcome  you  and  your 
distinguished  Committee  to  Houston.  The  work  of  your  committee  has  been 
of  highly  significant  value  to  the  Coast  Guard,  and  to  us  who  are  charged 
with  day-by-day  responsibility  to  insure  the  safety  of  the  Port  of  Houston 
and  the  crews  of  ships.  Hazardous  materials  play  a  very  significant  part 
in  the  Houston  area.  We  hope  your  stay  with  us  will  be  fruitful  and 
worthwhile.  My  staff  and  I  stand  ready  to  assist  you  in  whatever  way  we 
can  during  your  conference,  and  we  hope  you  will  return  often. 
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Welcome  from  CAPTAIN  D.  F.  HALL,  O.C.M.I. 


Professor  Katz,  Committee  Members  and  guests: 

Captain  West  has  expressed  our  pleasure  at  your  selection  of 
Houston  for  your  1971  conference.  The  Office  in  Charge  of  Marine 
Inspection,  Houston,  likewise  is  at  your  service,  and  we  will  be 
pleased  to  join  you  in  working  to  our  common  objectives.  God 
speed  in  your  endeavors. 
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benefit-cost  studies  in  socio-technical  systems 


Dean 


Chauncey  Starr 


,  School  of  Engineering  and  Applied  Science 
University  of  California,  Los  Angeles 


Introduction 


The  general  problem  of  balancing  utility  versus  total  societal 
costs  should  be  a  part  of  all  planning  in  our  society.  Tradition¬ 
ally,  technical  performance  as  a  function  of  monetary  cost  is 
always  involved  in  engineering  design  decisions.  What  we  are  dis¬ 
cussing  however  is  inclusion  of  all  societal  costs,  indirect  as  well 
as  direct,  and  all  measures  of  utility,  direct  as  well  as  indirect. 
Clearly,  existent  social-technical  systems,  over  a  period  of  many 
years,  have  developed  an  empirically  acceptable  balance  between 
utility  and. social  cost.  In  addition,  we  have  examples  of  national* 
decision  making  involving  future  social  technical  systems  which 
contain  implicit  predictive  trade-offs  of  societal  benefits  versus 
societal  costs. 

As  the  number  of  our  socio-technical  systems  increase  and  their 
impact  on  the  individual  becomes  more  apparent,  concern  with  achieving 
a  planned  balance  of  the  utility  of  these  systems  against  their 
societal  costs  has  also  increased.  It  has  become  apparent,  therefore, 
that  greater  insight,  analysis  and  predictive  planning  are  essential 
for  the  future  development  of  new  or  larger  socio-technical  systems. 

These  problems  originate  from  certain  general  assumptions  inherent 
in  the  operations  of  our  society.  First,  it  is  traditionally  accepted 
that  everyone  should  have  the  opportunity  for  a  natural  death,  that 
is,  a  death  from  old  age,  from  a  natural  wearing  out  of  the  human 
body.  Second,  rt  is  now  commonly  accepted  that  every  individual 
should  have  the  opportunity  to  use  and  enjoy  the  fruits  of  our  cen¬ 
turies  of  technological  development.  Third,  more  recently  we  have 
emphasized  our  responsibility  to  assure  for  succeeding  generations 
the  best  environmental  and  genetic  inheritance  that  we  can  provide. 

And  fourth,  it  ic  the  philosophy  of  an  egalitarian  society  that 
where  the  activities  of  an  individual  infringes  on  others  in  an 
undesirable  way,  the  society  may  intervene  to  control  individual 
activities  in  order  to  achieve  a  balance  between  group  well-being 
and  the  privileges  of  the  individual. 
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It  is  evident  that  these  inherent  basic  assumptions  are  not  fvilly 
compatible.  Technology's  contribution  to  enlarging  the  range  of 
personal  powers  of  the  individual  unfortunately  also  provides  the 
individual  with  the  power  to  damage  others.  In  fact,  the  usual 
situation  is  that  the  benefits  of  technology  are  concentrated  on 
the  user,  but  the  penalties  are  diffusely  spread  to  many.  Under 
these  circumstances,  the  governing  agencies  of  our  society  intervene 
and  impose  controls  on  both  the  individual  and  the  technological 
system.  Unfortunately,  the  criteria  used  by  our  society  to  achieve 
this  balance  of  group  and  individual  interests  are  rarely  explicit, 
and  are  most  often  hidden  in  the  complex  empirical  adjustments  of 
our  social,  political,  and  economic  subsystems. 

We  now  face  a  general  situation  in  which  widespread  use  of  a  new 
technological  development  may  occur  before  its  social  impact  can  be 
properly  assessed,  and  before  any  empirical  adjustment  of  the 
benefit-versus-cost  relation  is  obviously  indicated.  It  has  been 
clear  for  some  time  that  predictive  technological  assessments  are 
a  pressing  societal  need.  However,  even  if  such  assessments  become 
available,  obtaining  maximum  social  benefit  at  minimum  cost  also 
requires  the  establishment  of  a  relative  value  system  for  the  basic 
parameters  in  our  objective  of  improved  "quality  of  life."  The 
empirical  approach  implicitly  involved  an  intuitive  societal  bal¬ 
ancing  of  such  values.  A  predictive  analytical  approach  will  re¬ 
quire  an  explicit  scale  of  relative  social  values. 

For  example,  if  technological  assessment  of  a  new  development  pre¬ 
dicts  an  increased  per  capita  annual  income  of  x  percent  but  also 
predicts  an  associated  annual  per  capita  accident  probability  of  y 
fatalities,  then  how  are  these  to  be  compared  in  their  effect  on  the 
"quality  of  life?"  Because  the  penalties  or  risks  to  the  public 
arising  from  a  new  development  can  be  reduced  by  applying  constraints, 
there  will  usually  be  a  functional  relationship  (or  trade-off) 
between  utility  and  risk,  the  x  and  y  of  our  example. 
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In  order  to  provide  insight  to  this  problem  of  societal  criteria 
for  evaluating  benefits  versus  costs,  I  undertook  a  study  of  a 
specific  one  of  our  social  values  —  fatalities  arising  from  socio- 
technological  systems.  A  quantitative  analysis  has  been  made  of 
accidental  deaths  arising  from  technological  developments  in  public 
use.  This  analysis  was  used  to  develop  some  generalized  understand¬ 
ing  of  the  public's  approach  to  this  social  balance.  The  initial 
results  were  published  in  Science,  Vol.  165,  p.  1232-38,  19  Sep¬ 
tember  1969. 

The  analysis  makes  two  assumptions.  The  first  is  that  historical 
national  accident  records  do  contain  consistent  patterns  of  fatalities 
in  the  public  use  of  technology.  The  second  assumption  is  that  such 
historically  revealed  social  preferences  and  values  are  sufficiently 
enduring  to  permit  their  use  for  predictive  purposes.  We  have  evi¬ 
dence  that  these  assumptions  may  not  be  adequate  in  all  cases. 

Quite  clearly  in  the  technological  trade-offs  involving  environmental 
pollution,  historical  data  is  not  available.  Nevertheless,  in  those 
areas  where  information  has  been  available  for  a  considerable  time, 
the  study  is  revealing. 

There  are  many  historical  illustrations  of  such  trade-off  relation¬ 
ships  that  were  empirically  determined.  For  example,  automobile 
and  airplane  safety  have  been  continuously  weighed  by  society  against 
economic  costs  and  operating  performance.  In  these  and  other  cases, 
the  real  trade-off  process  is  actually  one  of  dynamic  adjustment, 
with  the  behavior  of  many  portions  of  our  social  systems  out  of  phase, 
due  to  the  many  separate  "time  constants"  involved. 

Readily  available  historical  data  on  accidents  and  health,  for  a 
variety  of  public  activities,  provide  an  enticing  stepping-stone  to 
quantitative  evaluation  of  this  particular  type  of  social  cost.  The 
social  benefits  arising  from  seme  of  these  activities  can  be  roughly 
determined.  On  the  assumption  that  in  such  historical  situations  a 
socially  acceptable  and  essentially  optimum  trade-off  of  values  is 
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being  approached  or  has  been  achieved,  we  could  say  that  any  gen¬ 
eralizations  developed  might  then  be  used  for  predictive  purposes. 
This  approach  could  give  a  rough  answer  to  the  seemingly  simple 
question  "How  safe  is  safe  enough?"  Because  this  methodology  is 
based  on  historical  data,  it  does  not  serve  to  distinguish  what  is 
"best"  for  society  from  what  is  "traditionally  acceptable."  It 
also  does  not  establish  cause-effect  relationships  —  rather,  only 
the  observable  results  of  the  cumulative  operations  of  our  social 
system. 


Voluntary  and  Involuntary  Activities 

Societal  activities  fall  into  two  general  categories  —  those  in 
which  the  individual  participates  on  a  "voluntary"  basis  and  those 
in  which  the  participation  is  "involuntary,"  imposed  by  the  society 
in  which  the  individual  lives.  The  process  of  empirical  optimiza¬ 
tion  of  benefits  and  costs  is  fundamentally  similar  in  the  two 
cases  —  namely,  a  reversible  exploration  of  available  options  —  but 
the  time  required  for  empirical  adjustments  (the  time  constants  of 
the  system)  and  the  criteria  for  optimization  are  quite  different 
in  the  two  situations. 

In  the  case  of  "voluntary"  activities,  the  individual  uses  his  own 
value  system  to  evaluate  his  experiences.  Although  his  eventual 
trade-off  may  not  be  consciously  or  analytically  determined,  or  based 
upon  objective  knowledge,  it  nevertheless  is  likely  to  represent, 
for  that  individual,  a  crude  optimization  appropriate  to  his  value 
system.  For  example,  an  urban  dweller  may  move  to  the  suburbs 
because  of  a  lower  crime  rate  and  better  schools,  at  the  cost  of 
more  time  spent  traveling  on  highways  and  a  higher  probability  of 
accidents.  If,  subsequently,  the  traffic  density  increases,  he  may 
decide  that  the  penalties  are  too  great  and  move  back  to  the  city. 
Such  an  individual  optimization  process  can  be  comparatively  rapid 
(because  the  feedback  of  experience  to  the  individucl  is  rapid) ,  so 
the  statistical  pattern  for  a  large  social  group  may  be  an  important 
"real-time"  indicator  of  societal  trade-offs  and  values. 
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"Involuntary"  activities  differ  in  that  the  criteria  and  options 
are  determined  not  by  the  individuals  affected  but  by  a  controlling 
body.  Such  control  may  be  in  the  hands  of  a  government  agency,  a 
political  entity,  a  leadership  group,  an  assembly  of  authorities 
or  "opinion-makers,"  or  a  combination  of  such  bodies.  Because  of 
the  complexity  of  large  societies,  only  the  control  grouD  is  likely 
to  be  fully  aware  of  all  the  criteria  and  options  involved  in  their 
decision  process.  Further,  the  time  required  for  feedback  of  the 
experience  that  results  from  the  controlling  decisions  is  likely  to 
be  very  long.  The  feedback  of  cumulative  individual  experiences 
into  societal  communications  channels  (usually  political  or  economic) 
is  a  slow  process,  as  is  the  process  of  altering  the  planning  of 
the  control  group.  We  have  many  examples  of  such  "involuntary"' 
activities,  war  being  perhaps  the  most  extreme  case  of  the  opera¬ 
tional  separation  of  the  decision-making  group  from  those  most 
affected.  Thus,  the  real-time  pattern  of  societal  trade-of  :s  on 
"involuntary"  activities  must  be  considered  in  terms  of  the  particu¬ 
lar  dynamics  of  approach  to  an  acceptable  balance  of  social  values 
and  costs.  The  historical  trends  in  such  activities  may  therefore 
be  more  significant  indicators  of  social  acceptability  than  the 
existent  trade-offs  are. 

In  examining  the  historical  benefit-risk  relationships  for  "involun¬ 
tary"  activities,  it  is  important  to  recognize  the  perturbing  role 
of  public  psychological  acceptance  of  risk  arising  from  the  influence 
of  authorities  or  dogma.  Because  in  this  situation  the  decision¬ 
making  is  separated  from  the  affected  individual,  society  lias  gen¬ 
erally  clothed  many  of  its  controlling  groups  in  an  almost  impene¬ 
trable  mantle  of  authority  and  of  imputed  wisdom.  The  public 
generally  assumes  that  the  decision-making  process  is  based  on  a 
rational  analysis  of  social  benefit  and  social  risk.  While  it  often 
is,  we  have  all  seen  after-the-fact  examples  of  irrationality.  It 
is  important  to  omit  such  "witch  doctor"  situations  in  selecting 
examples  of  optimized  "involuntary"  activities,  because  in  fact  these 
situations  typify  only  the  initial  stages  of  exploration  of  options. 
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The  Continuum  of  Risk  Exposure 

Fatalities  may  arise  from  technological  systems  as  either  the  re¬ 
sult  of  discrete,  statistical  events,  i.e.,  the  true  accident  — 
or  as  a  result  of  a  continuous  exposure  to  a  cumulative  hazard,  i.e., 
environmental  pollution.  Although  the  distinction  usually  may  be 
unimportant  for  an  annual  actuarial  analysis  — as  in  the  case  of  motor 
vehicle  deaths  — both  the  societal  and  individual  reaction  to  the 
risk  is  generally  different.  This  is  best  illustrated  by  considering 
the  extreme  case  of  infrequent  discrete  catastrophes. 

A  tabulation  of  such  catastrophes,  both  man-made  and  natural,  are 
shown  in  Table  1.  The  frequency  of  events  is  very  low,  with  a 

• 

thousand-fold  range  of  fatalities  per  event.  If  one  excludes  the 
people  directly  affected,  the  societal  response  to  such  a  range  of 
catastrophes  is  roughly  uniform.  The  dramatic  impact  communicated 
by  the  news  media  (newspapers,  radio,  TV)  is  about  the  same  for  the 
crash  of  a  large  commercial  airliner,  the  hurricane  damage  over  a 
large  territory,  or  the  massive  loss  of  life  in  an  extreme  earth¬ 
quake  . 

It  is  likely  that  the  very  low  frequency  of  such  events  tends  to 
reduce  their  significance  to  the  observer.  The  typical  individual 
reaction  is  that  these  events  are  so  rare  both  in  time  and  location, 
that  the  consequent  individual  risk  is  negligible.  So,  the  concept 
of  "if  will  never  happen  to  me"  is  easily  accepted. 

However,  these  infrequent  catastrophes  are  generally  the  end-points 
of  a  continuous  spectrum  of  like  events,  whose  frequency  increases 
expo -  oiM  i ally  as  their  individual  severity  decrease.  The  typical 
logarithmic  relationship  is  shown  in  Figure  1,  where  the  frequency 
and  magnitudes  of  earthquakes  arc  compared.  The  rapidly  increasing 
frequency  with  diminishing  severity  of  earthquakes  begins  to  approach 
a  steady  series  of  tremors.  The  public  awareness  of  this  exposure  is, 
of  course,  limited  to  the  severe,  infrequent  earthquakes  that  do 
visible  harm. 
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SINGLE  EVENT  MAJOR  CATASTROPHES 
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A  similar  continuum  of  frequency  logarithmically  inverse  to  severity 
can  be  shown  in  an  analysis  of  motor  vehicle  accidents.  In  Figure  2 
is  shown  the  annual  number  of  motor  vehicle  accidents  in  the  State 
of  California  for  the  years  1968  and  1969  as  a  function  of  the  number 
of  vehicles  involved  in  the  accident.  Because  the  vehicle  population 
in  California  is  very  large  (more  than  9  million  registered)  and 
the  accidents  are  roughly  stochastically  random,  the  frequency  versus 
severity  curve  may  be  expected  to  approximate  a  Poisson  probability 
law  -  similar  to  that  shown  in  Figure  2. 

The  continuous  spectrum  of  damaging  events  is  also  illustrated  by 
theoretical  studies  of  hypothetical  nuclear  power  plant  accidents. 

A  recent  analysis  by  Otway*  for  a  typical  pressurized  water  reactor 
1000  MWe  power  plant  has  given  the  results  shown  in  Figure  3,  The 
similarity  to  the  earthquake  curves  is  apparent.  Here  the  proba¬ 
bility  per  year  (or  frequency)  approximately  varies  inversely  as  the 
square  of  the  fission  product  release  per  event.  Figure  3  also  shows 
that  there  is  a  characteristic  probability  curve  for  each  type  of 
accident  chain.  This  would  be  expected,  as  major  differences  in 
initiating  events  produce  largely  different  accident  sequences. 

The  spectrum  of  relationships  between  accident  frequency  and  their 
severity  may  be  generalized  by  the  three-dimensional  sketch  shown  in 
Figure  4.  The  range  of  disability  goes  from  minor  inconvenience  to 
death.  At  each  point  on  this  disability  scale,  is  an  associated 
curve  of  frequency  versus  the  number  of  people  involved.  In  this 
paper,  I  have  chosen  to  discuss  only  the  fatal  end  point.  However, 
a  complete  study  would  integrate  the  effects  of  all  accidents,  minor 
to  fatal,  and  with  proper  cost  factors,  determine  the  total  weighted 
public  risk  and  the  social  cost.  Even  for  fatalities  alone,  the 
weighting  factor  of  age  is  very  significant  — as  shown  in  Figure  5. 
This  type  of  comprehensive  analysis  should  be  undertaker;  for  a 


H.J.  Otway,  "The  Application  of  Risk  Allocation  to  Reactor  Siting 
and  Design . "  1969.  Ph.D.  Thesis,  UCLA.  Los  Alamos  Scientific 
Laboratory,  University  of  California,  LA-4316. 
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IHSERT  In  addition  to  the  probability  curve  for  the  magnitude  of  an  accident 
each  individual  size  of  accident  produces  a  variety  of  public  impacts 
ranging  from  minor  disabilities  to  death.  As  one  would  expect,  the 
bulk  of  data  available  for  specific  accident  types,  as  for  example, 
motor  vehicle  collisions,  all  indicate  that  the  number  of  minor  dis¬ 
abilities  is  very  much  greater  than  the  fatalities.  Although  good 
data  is  generally  lacking  to  properly  quantify  such  distribution  of 
effects,  the  same  general  characteristic  appears  to  apply  to  most 
public  exposures  to  hazards.  For  example,  in  Figure  3'  the  impact  of 
sulfur  dioxide  air  pollution  on  public  health  is  shown  in  an  approxi¬ 
mate  manner.  This  is  a  typical  dosage  relationship  with  a  major 
influence  of  dose  rate.  Proper  evaluation  of  public  hazards  should 
include  estimates  of  those  non-lethal  disability  effects. 
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LIFETIME  EARNINGS  (IN  THOUSANDS) 


meaningful  benefit-cost  comparison  for  a  specific  technical  system. 
This  paper  is  not  intended  to  be  comprehensive,  and  reviews  only 
the  scope  and  magnitude  of  the  basic  methodology. 

The  nuclear  power  plant  example  mentioned,  raises  some  fundamental 
questions  about  our  societal  approach  to  public  risk.  The  dramatic 
aspect  of  the  unfamiliar  large  catastrophe  —  but  with  exceedingly 
low  probability  -  tends  to  draw  both  public  attention  anu  concern. 
Unlike  the  natural  catastrophes  —  earthquakes,  typhoons,  floods, 
tidal  waves,  etc.  -  society  has  not  learned  to  place  such  hypothet¬ 
ical  man-made  events  in  an  acceptable  comparative  perspective, 
particularly  when  they  are  poorly  understood  by  the  public.  If, 
in  fact,  the  low  release  events  are  of  more  importance,  the  concern 
with  imaginary  large  catastrophes  may  seriously  distort  both  societal 
policy  decisions  and,  as  a  result,  engineering  design  emphasis. 

In  the  particular  case  of  nuclear  power,  it  is  unlikely  that  this 
issue  will  be  resolved  by  practical  experience.  The  probability 
of  the  large  events  plotted  in  Figure  3  are  so  low,  that  actuarial, 
insight  based  on  the  statistics  of  real  nuclear  accidents  will  prob¬ 
ably  never  exist.  It  is  important  to  recognize  the  comparative 
scale  of  the  extremely  small  probabilities  involved  in  the  nuclear 
accident  chain  shown  in  Figure  3.  Let  us  use  as  a  comparative 
measure  natural  disasters  -  floods,  earthquakes,  tornadoes,  and 
storms.  Averaged  over  the  U.S.,  these  cause  five  to  ten  deaths  per 
million  population  per  year.  The  probability  of  causing  this  same 
level  of  fatalities  by  the  nuclear  accident  chain  of  Figure  3  is  less 
than  10  ®  per  year  —  that  is,  once  in  a  million  years  of  operation 
of  a  nuclear  power  station. 

It  is,  of  course,  very  comforting  that  the  public  risk  from  nuclear 
power  plant  accidents  is  in  fact  so  low.  However,  it  does  emphasize 
the  importance  of  the  analytic  approach  to  risk  assessment,  and  the 
development  of  a  societal  philosophy,  perspective,  and  criteria  for 
evaluating  the  benefit-risk  relationships.  Ilow  should  we  approach 
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the  "once  in  a  hundred  years"  earthquake,  or  the  somewhat  equiva¬ 
lent  "once  in  a  million  years"  nuclear  accident?  Do  »/e  passively 
accept  the  first  and  not  the  second?  Both  risks  can  be  reduced 
by  preventive  engineering  design  and  added  costs.  What  is  the  value 
to  our  society  in  allocating  resources  now  for  reducing  such  time- 
reiuote  risks?  What  is  a  "negligible"  risk  —  that  is,  one  which  we 
consciously  decide  to  neglect?  When  do  we  philosophically  shift 
the  burden  of  responsibility  from  an  "act  of  man"  to  an  "act  of 
God?" 

It  is  to  these  questions  that  the  remainder  of  this  discussion  will 
be  addressed  —  with  the  objective  of  suggesting  a  methodology  for 
a  rough  quantitative  approach  to  their  answers. 

Quantitative  Correlations 

Kith  this  definition  of  the  problem,  and  the  associated  caveats,  we 
are  in  a  position  to  discuss  the  quantitative  correlations.  For 
the  sake  of  simplicity,  the  measure  of  the  risk  to  the  individual 
has  been  restricted  to  the  fatalities  (deaths)  associated  with  each 
type  of  activity.  Although  it  clearly  would  be  useful  to  include 
all  injuries  (which  are  109  to  1000  times  as  numerous  as  deaths) , 
the  difficulty  in  obtaining  data  and  the  unequal  penalties  of  varying 
disabilities  would  introduce  inconvenient  complexity  for  this  study. 
So  the  risk  measure  used  here  is  the  statistical  probability  of 
fatalities  per  hour  of  exposure  of  the  individual  to  the  activity 
considered. 

The  hour-of-exposure  unit  was  chosen  because  it  was  deemed  more 
closely  related  to  the  individual's  intuitive  process  in  choosing  ~.n 
activity  than  a  year  of  exposure  would  be,  and  gave  substantial)/ 
similar  results.  Another  possible  alternative,  the  risk  per  rctiv- 
ity,  involved  a  comparison  of  too  many  dissimilar  units  of.  measure; 
thus,  in  comparing  the  risk  for  various  modes  of  transportation, 
one  could  use  risk  per  hour,  per  mile,  or  per  trip.  As  this  study 
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was  directed  toward  exploring  a  methodology  for  determining  social 
acceptance  of  risk,  rather  than  the  safest  mode  of  transportation 
for  a  particular  trip,  the  simplest  common  unit  —  that  of  risk  per 
exposure  hour  —  was  chosen. 

The  social  benefit  derived  from  each  activity  was  converted  into  a 
dollar  equivalent,  as  a  measure  of  integrated  value  to  the  individual. 
This  is  perhaps  the  most  uncertain  aspect  of  the  correlations  be¬ 
cause  it  reduced  the  "quality-of-life "  benefits  of  an  activity  to 
an  overly  simplistic  measure.  Nevertheless,  the  correlations  seemed* 
useful,  and  no  better  measure  was  available.  In  the  case  of  the 
"voluntary"  activities,  the  amount  of  money  spent  on  the  activity 
by  the  average  involved  individual  was  assumed  proportional  to  its 
benefit  to  him.  In  the  case  of  the  "involuntary"  activities,  the 
contribution  of  the  activity  to  the  individual's  annual  income  (or 
the  equivalent)  was  assumed  proportional  to  its  benefit.  This 
assumption  of  roughly  constant  relationship  between  benefits  and 
monies,  for  each  class  of  activities,  is  clearly  an  approximation. 
However,  because  we  are  dealing  in  orders  of  magnitude,  the  distor¬ 
tions  likely  to  be  introduced  by  this  approximation  are  relatively 
small. 

In  the  case  of  transportation  modes,  the  benefits  were  equated  with 
the  sum  of  the  monetary  cost  to  the  passenger  and  the  value  of  the 
time  saved  by  that  particular  mode  relative  to  a  slower,  competitive 
mode.  Thus,  airplanes  were  compared  with  automobiles,  and  automo¬ 
biles  were  compared  with  public  transportation  or  walking.  Benefits 
of  public  transportation  were  equated  with  their  cost.  In  all  cases, 
the  benefits  were  assessed  on  an  annual  dollar  basis  because  this 
seemed  to  be  most  relevant  to  the  individual's  intuitive  process. 

For  example,  most  luxury  sports  require  an  investment  and  upkeep 
only  partially  dependent  upon  usage.  The  associated  risks,  of  course, 
exist  only  during  the  hours  of  exposure. 

Probably  the  use  of  electricity  provides  the  best  example  of  the 
analysis  of  an  "involuntary"  activity.  In  this  case  the  fatalities 
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include  those  arising  from  electrocution,  electrically  caused  fires, 
the  operation  of  power  plants,  and  the  mining  of  the  required  fossil 
fuel.  The  benefits  were  estimated  from  a  United  Nations  study  of 
the  relationship  between  energy  consumption  and  national  income. 

The  contributions  of  the  home  use  of  electric  power  to  our  "quality 
of  life"  -  more  subtle  than  the  contributions  of  electricity  in 
industry  —  are  omitted.  The  availability  of  refrigeration  has  cer¬ 
tainly  improved  our  national  health  and  the  quality  of  dining.  The 
electric  light  has  certainly  provided  great  flexibility  in  patterns 
of  living,  and  television  is  a  positive  element.  Perhaps,  however, 
the  gross-income  measure  used  in  the  study  is  sufficient  for  pre¬ 
sent  purposes. 

Information  on  acceptance  of  "voluntary"  risk  by  individuals  as  a 
function  of  income  benefits  is  not  easily  available,  ?lthough  we 
know  that  such  a  relationship  must  exist.  Of  particular  interest, 
therefore,  is  the  special  case  of  miners  exposed  to  high  occupational 
risks.  In  Figure  6,  the  accident  rate  and  the  severity  rate  of 
mining  injuries  are  plotted  against  the  hourly  wage.  The  acceptance 
of  individual  risk  is  an  exponential  function  of  the  wage,  and  can 
be  roughly  approximated  by  a  third-power  relationship  in  this  range. 

Risk  Comparisons 

As  u  reference  level  for  comparing  risks,  it  seemed  appropriate  to 
take  the  risk  of  death  due  to  disease.  This  is  shown  in  Figure  7 
for  the  U.S,  population,  both  for  disease  and  accidents.  The  average 
accident  fraction  is  about  one- tenth  of  the  disease  average,  and  its 
presence  is  not  significant.  However,  if  one  considers  the  younger 
population  (10-30) ,  the  disease  level  is  a  magnitude  less  than  the 
average,  and  the  accident  level  is  actually  larger.  The  reverse  is 
obviously  true  for  the  oldest  group.  In  a  more  complete  study,  the 
varying  value  of  human  life  with  age  —  from  a  societal  viewpoint  - 
would  require  special  emphasis  on  the  age  group  from  20-50  years, 
whose  social  value  may  be  several  times  that  of  the  younger  and 
older.  Aside  from  the  complex  humanistic  judgments  intrinsic  to 
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this  approach,  the  present  study  is  too  general  to  justify  this 

ref  j  neir.ent. 

The  results  for  the  societal  activities  studied,  both  "voluntary" 
and  "involuntary,"  are  assembled  in  Figure  8.  Also  shown  in  Figure 
8  is  the  third-power  relationship  between  risk  and  benefit  character 
istic  of  Figure  6.  The  average  risk  of  death  from  disease  is  indi¬ 
cated  for  comparison. 

Several  major  features  of  the  benefit-risk  relations  are  apparent, 
the  most  obvious  being  the  difference  by  several  orders  of  magnitude 
in  society's  willingness  to  accept  "voluntary"  and  "involuntary" 
risk.  As  one  would  expect,  we  are  loathe  to  let  others  do  unto  us 
what  we  happily  do  to  ourselves. 

The  rate  of  death  from  disease  appears  to  play,  psychologically,  a 
yardstick  role  in  determining  the  acceptability  of  risk  on  a  volun¬ 
tary  basis.  The  risk  of  death  in  most  sporting  activities  is 
surprisingly  close  to  the  risk  of  death  from  disease  -  almost  as 
though,  in  sports,  the  individual's  subconscious  computer  adjusted 
his  courage  and  made  him  take  risks  associated  with  a  fatality  level 
equaling  but  not  exceeding  the  statistical  mortality  due  to  involun¬ 
tary  exposure  to  disease.  Perhaps  this  defines  the  demarcation  be¬ 
tween  boldness  and  foolhardiness. 

The  simple  ratio  of  benefit  to  risk  is  conventionally  used  as  an 
index  of  societal  acceptability.  This  is  not  consistent  with  the 
hypothesized  logarithmic  relationship  of  Figure  8.  As  one  moves 
toward  higher  benefits  along  either  suggested  band,  the  benefit/risk 
ratio  drops  rapidly  due  to  the  R^D  relation.  Thus,  the  simple 
ratio  is  apt  to  be  quite  misleading  in  considering  social  value 
and  acceptability  of  an  activity. 

The  risks  associated  with  general  aviation,  commercial  aviation, 
and  travel  by  motor  vehicle  deserve  special  comment.  The  latter 
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originated  as  a  "voluntary"  sport,  but  in  the  past  half-century 
the  motor  vehicle  has  become  an  essential  utility.  General  aviation 
is  still  a  highly  voluntary  activity.  Commercial  aviation  is  partly 
voluntary  and  partly  essential  and,  additionally,  is  subject  to 
government  administration  as  a  transportation  utility. 

Travel  by  motor  vehicle  has  now  reached  a  benefit-risk  balance,  as 
shown  in  Figure  9.  It  is  interesting  to  note  that  the  present  risk 
level  is  only  slightly  below  the  basic  level  of  risk  from  disease. 

In  view  of  the  high  percentage  of  the  population  involved,  this 
probably  represents  a  true  societal  judgment  on  the  acceptability 
of  risk  in  relation  to  benefit.  It  also  appears  from  Figure  9  .that 
future  reductions  in  the  risk  level  will  be  slow  in  coming,  even 
if  the  historical  trend  of  improvement  can  be  maintained. 

Commercial  aviation  has  barely  approached  a  risk  level  comparable  to 
that  set  by  disease.  The  trend  is  similar  to  that  for  motor  vehicles, 
as  shown  in  Figure  10.  However,  the  percentage  of  the  population 
participating  is  now  only  1/20  that  for  motor  vehicles.  Increased 
public  participation  in  commercial  aviation  will  undoubtedly  increase 
the  pressure  to  reduce  the  risk,  because,  for  the  general  population, 
the  benefits  arc  much  less  than  those  associated  with  motor  vehicles. 
Commercial  aviation  has  not  yet  reached  the  point  of  optimum  benefit- 
risk  trade-off. 

For  general  aviation  the  trends  are  similar,  as  shown  in  Figure  11. 
Here  the  risk  levels  are  so  high  (20  times  the  risk  from  disease) 
that  this  activity  must  properly  be  considered  to  be  in  the  category 
of  adventuresome  sport.  However,  the  risk  is  decreasing  so  rapidly 
that  eventually  the  risk  for  general  aviation  may  be  little  higher 
than  that  for  commercial  aviation.  Since  the  percentage  of  the 
population  involved  is  very  small,  it  appears  that  the  present  average 
risk  levels  are  acceptable  to  only  a  limited  group. 
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%  OF  TOTAL  U.S.  POPULATION  INVOLVEO 


RISK  AND  PARTICIPATION  TRENDS 
FOR 

GENERAL  AVIATION 


Farm  tractor  accidents  do  not  conform  to  this  general  trend  that 
increased  population  participation  results  in  decreased  individual 
risk.*  Figure  12  shows  the  growth  in  the  mechanization  of  agricul¬ 
ture  in  the  past  half  century,  but  not  much  change  in  the  individual 
risk.  This  situation  might  indicate  that  the  risk  arises  from  the 
mode  of  use  of  the  tractor,  rather  than  inadequate  machine  design. 

In  view  of  the  highly  variable  terrain,  and  types  of  operation  in 
which  tractors  are  used,  it  is  likely  that  the  P^  level  is  estab¬ 
lished  by  the  individual  operator  as  acceptable  to  him. 

A  group  risk  (risk  x  population  exposed)  study  has  been  made  for 
nonmilitary  vessels, +  shown  in  Figure  13.  The  span  of  eight  years 
(1960-68)  is  too  short  to  show  long  term  trends.  However,  the  dif¬ 
ference  in  risk  between  recreational  boating  and  commercial  vessels 
again  shows  the  1000  or  more  spread  between  voluntary  and  involuntary 
exposures  accepted  by  the  participants.  The  traditional  risks  of  the 
professional  seamen  and  fishermen  appear  modest  as  compared  to  that 
of  the  daily  commuter  driving  to  work. 

Public  Awareness 

Finally,  I  attempted  to  relate  these  risk  data  to  a  crude  measure  of 
public  awareness  of  the  associated  social  benefits  (see  Figure  14) . 
The  "benefit  awareness"  was  arbitrarily  defined  as  the  product  of 
the  relative  level  of  advertising,  the  square  of  the  percentage  of 
population  involved  in  the  activity,  and  the  relative  usefulness 
(or  importance)  of  the  activity  to  the  individual.  Perhaps  these 
ass”mptions  are  too  crude,  but  Figure  14  does  support  the  reasonable 
position  that  advertising  the  benefits  of  an  activity  increases 
public  acceptance  of  a  greater  level  of  risk.  This,  of  course,  could 
subtly  produce  a  fictitious  benefit-risk  ratio  —  as  may  be  the  case 
for  smoking. 


I - ; - - - 

Private  communication:  James  E.  Giesen,  Product  Safety  Department, 
Deere  &  Company,  December  3,  1969. 

+Private  communication:  R.  J.  Bosnak,  Commander,  U.S.  Coast  Guard, 
December  24,  1969. 
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BENEFIT  AWARENESS 


This  study  is  only  an  exploratory  application  of  the  methodology 
of  historical  analysis  for  revealing  social  preferences,  values, 
and  benefit-cost  relationships.  On  the  specific  illustrative 
question:  "How  safe  is  safe  enough?"  it  does  reveal  several  inter¬ 
esting  points.  These  may  suggest  an  initial  basis  for  judicious 
national  decisions  on  involuntary  risk  associated  with  our  socio- 
technical  systems.  The  premises  for  such  a  societal  policy  may  be 
summarized  as  follows. 

1.  Rate  of  death  from  disease  is  an  upper  guide  in  determining 
the  acceptability  of  risk  —  somewhat  less  than  1  in  100  years. 

2.  Natural  disasters  ("acts-of-God")  tend  to  set  a  base  guide  for 
risk  —  somewhat  more  than  1  in  a  million  years  —  similar  to 
the  intrinsic  "noise"  level  of  physical  systems.  Man-made 
risks  at  this  level  can  be  considered  almost  negligible,  and 
can  certainly  be  neglected  if  they  are  several  magnitudes  less. 

3.  As  would  be  expected,  societal  acceptance  of  risk  increases 
with  the  benefits  to  be  derived  from  an  activity.  The  relation¬ 
ship  appears  to  be  nonlinear,  with  this  study  suggesting  that 
the  acceptable  level  of  risk  is  an  exponential  function  of  the 
benefits  (real  and  imaginary). 

4.  The  public  appears  willing  to  accept  "voluntary"  risks  roughly 
1000  times  greater  than  "involuntary"  exposure  risks. 

5.  The  quantitative  risk  analysis  of  a  specific  socio-technical 
system  —  such  as  atomic  power  —  should  take  into  account  the 
continuous  spectrum  of  accident  frequency  versus  severity,  both 
of  the  system  under  study  and  of  comparative  systems.  The 
present  study  has  not  entered  into  the  "fine-structure"  of  the 
problem.  A  more  definitive  and  intensive  analysis  is  needed 
for  application  to  specific  national  policy  guidelines. 

Conclusion 

Societal  policy  for  the  acceptability  of  public  risks  associated  with 
socio-technical  systems  should  be  determined  by  the  trade-off  between 
social  benefits  and  personal  risk.  As  suggested  above,  the  upper 
bound  of  such  risk  is  the  disease  level  and  the  lower  bound  is  several 
magnitude';  below  the  natural  disaster  level,  as  illustrated  in 
Figure  J'j.  This  provides  a  risk  trade-off  range  of  one  million  for 
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social  policy  determination  —  from  an  individual  risk  of  one  fatal 
accident  in  a  hundred  years,  to  one  in  a  hundred  million  years. 

It  is  evident  that  we  need  much  more  study  of  the  methodology  for 
evaluating  social  benefits  and  costs.  The  fatality  measure  of  publi 
risk  is  perhaps  more  advanced  than  most  because  of  decades  of  data 
collection.  Nevertheless,  even  the  use  of  crude  measures  of  both 
benefit  and  costs  would  assist  in  the  development  of  the  insight 
needed  for  national  policy  purposes.  We  should  not  be  discouraged 
by  the  complexity  of  this  problem  —  the  answers  are  too  important, 
if  we  want  a  rational  society. 
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TECHNOLOGY  AND  SAFETY  -  A  QUALITATIVE  VIEW 

by 
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ABSTRACT 


A  retrospective  analysie  of  the  contribution  of  new  technology  to 
improving  the  safety  of  society.  An  examination  of  the  risk  imposed 
by  a  new  technology  and  the  control  of  that  risk  by  increased  knowledge, 
by  legislation,  by  self-imposed  standards  and  by  social  pressure  from  an 


aware  consumer. 


TECHNOLOGY  AND  SAFETY  -  A  QUALITATIVE  VIEW 


Roy  Raider 


A  thoughtful  look  at  technology  and  society  will  show,  I  believe,  that 
new  technologies  tend  to  make  living  safer,  that  a  new  technology  replaces 
a  more  hazardous  one.  It  nay  be  equally  true  that  a  new  technology 
introduces  a  new  risk;  nevertheless,  that  new  risk  tends  to  lessen  with 
maturity  of  the  technology.  In  more  modem  times,  as  recently  as  this 
generation,  an  aware  society  is  more  critically  examining  the  technical 
contributions  for  their  safety  considerations. 

SEA  TRANSPORT 


The  greatest  practical  navigators  in  the  history  of  man  were  the  adventurous 
sailors  of  the  outrigger  canoes  of  the  Pacific  Islands.  As  these  tiny  islands 
and  atolls  were  hundreds  of  miles  apart  extraordinary  strength,  skill  and 
daring  were  required  to  move  between  islands  and  atolls.  Despite  the  unique 
abilities  of  these  intrepid  Mlcronet lane  the  continuing  loss  of  men  from 
hazardous  voyages  was  one  of  the  forces  that  helped  keep  population  in 
balance  with  the  tiny  land  masses. 

In  the  past  generation  outrigger  voyages  have  essentially  ceased.  With  the 
availability  of  power  boats  there  is  no  interest  in  the  more  primitive 
transport. 

I  offer  this  simple  example  of  a  theorem  that  a  new  technology  tends  to 
reduce  the  hazards  to  society. 
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In  this  example  ve  '>ae  that  transportation  of  man  with  Improved  navigational 
aids  and  more  reliable  transport  vehicles  has  been  a  continuing  technical 
contribution  to  mein's  safe  mobility. 

ANESTHESIA 

Shortly  before  the  middle  of  the  l<Hh  century  uwnkind  was  treated  to  a 
demonstration  of  triumph  over  pain  vh*n  anesthesia  vas  used  in  a  publicized 
surgical  procedure.  Before  this  time  there  had  been  some  use  of  anesthetic 
gases  and  vapors  but  only  in  an  uneven  fashion  and  then  often  in  fun  and 
games.  laughing  gas  demonstrations  and  ether  parties  were  actually  held 
for  public  view  and.  participation  and  sometimes  tickets  were  sold.  Both 
opium  and  alcohol  had  been  used  historically  but  they  were  not  reliable 
anesthetic  substances. 

In  18U6  ether  was  used  on  a  patient  undergoing  neck  surgery  in  Boston. 
Immediately  after  this  ether  waa  used  in  a  leg  amputation  in  Great  Britain. 
Later,  chloroform  was  given  Que.'a  Victoria  in  childbirth. 

Original  Ether  D*y,  Boston,  October  16,  18^6.  Dr.  Morton  (left) 
holds  inhaler  while  Dr.  J.  C.  Vfarren  excises  tumor  on  jaw  of 
patient.  Morton  wae  a  dentist  and  could  not  perform  surgery. 

First  amputation  under  ether  j  med  by  Sober!  Liston  in 
London,  December  21,  1846.  This  amputation  we*  timed  in  2ft 
seconds  as  speed  was  so  essential  in  pre-anesthesia  days. 

The  tremendous  gaiu  in  safety  contributed  by  new  technology  was  immediate 
and  obvious.  The  ehock  to  patients  from  the  pain  of  the  procedure  was 
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reduced;  the  physiciau  could  employ  more  deliberate  skill  with  a  patient 
submerged  in  coma.  Successfully  carried  out  were  procedures  that  heretofore 
could  hardly  be  attempted. 

Hove  •,  new  technology,  though  it  moderate  or  even  eliminate  an  old  risk, 
does  introduce  a  new  risk.  So  did  anesthesia.  There  were  a  variety  of 
problems:  liver  damage  from  the  toxicity  of  the  vapor,  hypoxia  from  a 

shortage  of  oxygen  and  a  depression  of  the  activity  of  the  respiratory  system. 

After  a  half  century  of  use  of  anesthesia-air  mixtures  oxygen  was  introduced. 
This  solved  many  of  the  physiological  safety  problems  and  Introduced  new 
physical  ones  of  increased  fire  and  explosion  risk.  The  enrichment  by  oxygen 
not  only  broadened  the  explosive  range  of  the  combustible  anesthetic  vapor 
but  also  significantly  reduced  the  amount  of  energy  necessary  to  ignite  the 
mixture . 

After  another  25  years  hydrocarbon  gases  such  as  ethylene  and  cyclopropane 
were  introduced.  These  gases  permitted  better  control  of  the  depth  and 
time  of  patient  submergence  but  with  very  little  energy  an  accidental 
ignition  could  occur. 

Control  measures  were  introduced  to  eliminate  ignition  sources.  Voluntary 
safety  standards  were  developed  beginning  on  a  national  basla  about  30 
years  ago. 

In  recent  years  the  over-all  death  rate  directly  attributable  to  anesthesia 
has  been  given  as  about  one  in  1000  cases;  the  mortality  rate  from  anesthesia 
explosions  is  estimated  at  less  than  one  in  1,000,000  anesthesias.  Itoe 
emotional  factors  involved  in  an  anesthetic  explosion,  however,  make  it 
feared  out  of  proportion  to  its  incidence.  Enormous,  almost  continuous, 
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gains  in  anesthetic  technique  gave  increasing  safety.  Today,  new  halogenated 
non- flammable  Inhalation  anesthetics  and  new  intravenous  agents,  also  non¬ 
flammable,  offer  promise  to  eliminate  any  need  for  heroic  control  of  ignition 
sources . 

These  safety  gains  have  not  required  much  social  legislation  other  than 
licensure  of  practitioners.  There  has  always  of  course  been  the  implied 
varied  penalties  of  accidents,  including  negotiated  or  court-ordered  costs 
where  negligence  might  be  demonstrated. 

BOILERS 


Well  before  the  middle  of  the  19th  century  steam  boilers  were  blowing  up 
with  astonishing  regularity,  causing  multiple  deaths  particularly  when 
they  occurred  on  steamboat' .  From  1025  to  1030  there  had  been  forty-two 
explosions  killing  about  273  persons. 

In  the  period  1041-1048  there  were  some  seventy  marine  explosions  that 
killed  about  625  persons.  The  toll  in  I85O  was  277  dead  from  explosions 
and  in  1051  it  rose  to  407. 

There  had  been  some  boiler  legislation  in  1838  but  it  was  ineffective. 

It  specified  inspection  of  boilers  but  did  not  qualify  the  inspectors; 
it  imposed  penalties  when  negligence  could  be  demonstrated  but  negligence 
was  infrequently  found  and  even  more  rarely  were  penalties  imposed.  Often 
if  an  inspection  were  too  strict  in  one  Jurisdiction  boats  would  seek  out 
another  jurisdiction  where  the  boiler  inspection  would  be  a  little  more 
casual . 
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In  1852  more  stringent  and  effective  boiler  legislation  waa  passed.  In  the 
decade  that  followed  accidents  dropped  significantly.  However  only 
steamboats  were  affected.  An  editor  of  a  technical  Journal  wrote  A  this 
time,  "Since  the  passage  of  the  law  steamboat  explosions  on  the  Atlantic 
have  become  almost  unknovn,  and  have  greatly  decreased  in  the  west.  With 
competent  inspectors,  this  law  is  invaluable,  and  we  hope  to  hail  the  day 
when  a  similar  act  is  passed  in  every  legislature,  touching  locomotives  and 
stationary  boilers." 

The  debate  for  the  1852  legislation  had  powerful  arguments  on  each  side: 

A  major  argument  against  passage  was  the  threat  to  private  property  rights, 
in  the  following  words,  for  example: 

"It  is  this  -  how  far  the  Federal  Government. . .shall  be  permitted 
to  interfere  with  the  rights  of  personal  property  -  or  the  private 
business  of  any  citizen. . .under  the  influence  of  recent  calamities, 
too  much  sensibility  is  displayed  on  this  suhject...  I  hold  it  to 
be  my  imperative  duty  not  to  permit  my  feelings  of  humanity  and  kind¬ 
ness  to  interfere  with  the  protection  which  I  am  bound,  as  a  Senator 
of  the  United  States,  to  throw  around  the  liberty  of  the  citizen,  and 
the  investment  of  his  property,  or  the  management  of  his  own  business... 
what  will  be  left  of  human  liberty  if  we  progress  on  this  course  much 
further?  What  will  be,  by  and  by,  the  difference  between  citizens  of 
this  far-famed  Republic  and  the  serfs  of  Russia?  Can  a  man's  property 
be  said  to  be  his  own,  when  you  take  it  out  of  his  own  control  and  put 
it  into  the  hands  of  another,  though  he  may  be  a  Federal  officer?" 
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But  a  telling  argument  for  the  bill  used  these  words: 

"'I  consider  that  the  only  question  Involved  in  the  bill  is  this: 
Whether  we  shall  permit  a  legalized,  unquestioned,  and  peculiar 
class  in  the  community  to  go  on  committing  murder  at  will,  or 
whether  we  shall  make  such  enactments  as  will  compel  them  to  pay 
some  attention  to  the  value  of  life.'  It  was,  then,  a  question  of 
the  sanctity  of  private  property  rights  as  against  the  duty  of 
government  to  act  in  the  public  weal." 

By  1854  the  Journal  of  the  Franklin  Institute  was  courageous  enough  to  say: 
"Whenever  we  have  an  account  of  a  boiler  explosion,  we  hear 
the  cry  for  a  week  or  so  for  new  laws,  and  more  stringent 
provisions,  careful  inspection,  &c.,  &c.,  and  the  General, 

State,  and  Municipal  Governments  are  in  turn  solicited  for 
their  interference,  and  abused  for  the  negligence,  until 
the  epidemic  excitement  has  run  its  course  in  a  few  days, 
and  all  the  clamor  subsides,  to  be  re-awakened  by  a  new 
catastrophe." 

In  time  through  the  agency  of  a  professional  society,  the  American  Society 
of  Mechanical  Engineers,  uniform  boiler  codes  were  promulgated  and  adopted 
oy  states  and  municipalities. 

Thus,  the  reaction  of  the  informed  public,  expressed  by  Congress,  to  boiler 
explosions  caused  the  initiation  of  positive  regulation  of  private  enterprise 
through  a  governmental  agency.  The  solution  of  the  problem  of  bursting 
boilers  was  an  important  step  toward  the  Inauguration  of  the  regulatory  and 
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investigative  agencies  in  the  federal  government.  It  took  almost  three 
generations  to  reach  an  acceptable  level  of  safety.  Regulation,  as  under¬ 
stood  in  modern  times,  is  not  an  unacceptable  way  of  life  to  the  mercantile 
society.  Even  in  the  absence  of  regulation  originating  from  the  authority 
of  the  state  many  manufacturers  and  suppliers  of  dangerous  comnodities  vlll 
self-impose  restraints  in  the  interest  of  public  safety.  Such  restraint  of 
course  may  also  be  of  self-interest  to  avoid  restrictive  regulation  by  the 
state  or  simply  to  stay  in  business  through  the  acceptance  of  a  dangerous 
commodity  by  society  because  of  a  good  safety  record. 


LIGHTING  LEVELS 


In  looking  at  safety  changes  over  a  span  of  two  generations  one  must 
not  only  technical  gains  but  really  the  enormous  social  changes  that 
place.  These  social  requirements  for  comfort  and  enjoyment  perhaps 
gains  in  safety  and  health  as  much  as  technological  improvements. 


examine 

take 

influence 


Lighting  level  standards  (in  footcandles)  have  had  the  following  changes 


over  a  50-year  period: 

1916 

1966 

Stairways 

0.75 

30 

Toilets,  change  rooms 

1.00 

30 

Foundries 

2.00 

50 

Rough  work 

2.00 

40 

Drafting 

10.00 

200 

Fine  work,  precision  work 

4.00 

100-1C00 

Office  work 

5.00 

100 

General  storage 

0.25 

20 
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HURRICANE  CAMILLE 


I  have  been  told  by  a  meteorologist,  one  with  a  particular  knowledge  of 
large  scale  risk,  that  the  1969  hurricane  Camille  which  struck  the 
Gulf  Coast  was  the  most  severe  such  storm  to  hit  land  in  this  century. 

Had  Camille  struck  the  same  place  70  years  ago  the  loss  of  life  could 
reasonably  be  estimated  to  have  been  ten- fold  greater.  Early  warnings, 
saturated  public  communication,  good  transport  and  good  roads  permitted 
preparations  or  escape  so  that  loss  of  life  was  minimized.  On  the  other 
hand,  in  underdeveloped  areas  forces  of  nature  are  extraordinarily 
devastating  such  as  earth  quakes  in  Peru  or  storms  and  floods  in  Pakistan. 

PERMISSIBLE  WHOLE  BODY  DOSES 
for 

OCCUPATIONAL  EXPOSURES  TO  IONIZING  RADIATION 

A  second  theorem  on  techno_ogy  and  safety  is  that  when  a  new  technology 
introduces  a  risk  that  new  risk  tends  to  be  reduced  as  the  technology 
becomes  widespread.  Sometimes,  as  we  will  see  in  later  examples,  the 
technology  must  actually  prove  its  safety,  after  initial  introduction 
and  misadventure,  before  it  can  be  reestablished. 

Less  commonly,  a  technology  nay  have  to  demonstrate  its  safety  before 
initial  acceptance.  Nuclear  power  reactors  typifies  this  class.  An 
extraordinary  paradox  must  be  observed  here:  that  is,  freedom  from 
accidents  does  not  necessarily  demonstrate  a  sufficient  degree  of  safety. 
We  will  discuss  this  in  more  detail  later. 
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This  present  example  deals  with  permissible  occupational  exposures  to 
Ionizing  radiation.  During  the  early  years  of  this  century  the  dangers 
of  radiation  vere  recognized.  But  only  qualitative  standards  were  used; 
sort  of  "if  the  individual  showed  reddening  of  the  skin,  he  has  received 
too  much." 

In  the  1920's  the  first  limits  were  set  by  a  national  body  which  would  permit 
about  100  rem  per  year.  In  193^  this  limit  was  reduced  a  third  by  an 
international  body  and  reduced  by  two- thirds  by  a  United  States  regulation. 

In  195°  the  international  standard  permissive  dose  was  down  to  15  rem  per  year. 
Before  the  decade  was  over  this  was  further  reduced  two-thirds  and  is  today 
at  5  rem  per  year.  Even  with  this  relatively  low  permissible  limit  the 
number  of  exposed  workers  who  approach  the  allowed  level  is  only  a  few 
percent.  Current  design  standards  are  setting  as  a  practical  goal  levels  only 
one- fifth  of  the  permissible  dose;  this  predicts  a  future  allowable  standard 
of  one  rem  per  year.  This  dramatic  change  in  safety  level  was  accomplished 
by  regulation,  by  direction,  oy  state-of-the-art  improvements,  and  by 
realization  that  things  ought  to  be  and  could  be  done  more  safely. 


CRYOGENIC  FLUIDS 

In  October  19^  in  Cleveland,  Ohio  a  fire  and  explosion  occurred  in  a  plant 
designed  for  the  liquefaction,  storage  and  regasifying  of  natural  gas  (methane). 
This  was  then  the  only  plant  of  its  kind.  Large  quantities  of  gas  were  needed  for 
periods  of  peak  demand  -  namely,  the  winter  heating  season.  Formerly  the  site 
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of  a  water  gas  plant  (which  may  have  been  a  sparsely  settled  area  when  it  was 
built  50  or  more  years  before),  it  had  been  a  liquefied  gas  storage  location 
for  three  years.  Private  dwellings  were  as  close  as  100  feet  from  the  fuel; 
the  main  line  of  a  major  railroad,  and  a  foundry  were  also  only  short 
distances  away. 

A  structural  collapse  of  the  vertical  cylinder  tank  initiated  the  accident 
in  which  130  lives  were  lost  and  80  dwellings  destroyed.  The  significant 
lesson  learned  from  this  misadventure  was  that,  pending  the  ability  to 
demonstrate  reliability  of  materials  and  methods,  sites  should  be  selected 
with  regard  to  reasonably  safe  locations  to  surroundings,  particularly 
populated  areas.  Beginning  15  years  after  this  incident  liquefied  methane 
technology  renewed  its  activity  and  has  met  with  success  and  acceptance 
since. 

This  accident  involved  3,000,000  gallons  of  liquefied  methane.  In  recent 
months  I  have  been  consulted  on  similar  installations  planned  for  urban 
areas  which  will  have  50,000,000  gallons  of  fuel. 

Ships  now  sailing  between  International  ports  have  loads  in  the  range  of 
100,000  tons  of  this  desirable  commodity. 

Liquefied  fluorine  is  one  of  the  most  powerful  oxidizers  known;  all  organic 
materials,  and  even  water,  are  extremely  reactive  with  fluorine.  It  is 
extraordinarily  toxic  and  equally  corrosive;  contact  with  skin  may  produce 
burns  which  can  be  painful  and  difficult  to  heal.  Despite  its  hostile 
character  fluorine  has  been  handled  on  a  large  scale  for  more  than  2k  years 
without  a  disabling  i-Jury. 
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It  is  important  to  realize  that  even  the  so-called  "large  scale"  handling  of 
liquefied  fluorine  has  been  restricted  to  a  few  major  government  contractors 
and  that  the  large  volume  liquefied  hydrogen  work  has  been  in  the  hands  of  a 
few  government  contractors  and  well-managed  experienced  large  commercial 
suppliers.  When  a  technology  remains  under  the  control  of  a  responsible  few 
and  able  organizations  then  self- regulation  appears  to  produce  a  high  level 
of  safety,  often  sufficiently  acceptable  to  require  little  more  from  regulatory 
bodies.  The  more  widespread  is  the  use  of  a  dangerous  material,  the  more 
need  arises  for  control  with  the  force  of  law. 

KIWI  TNT 


A  controlled  power  excursion  in  a  prototype  nuclear  rocket  was  carried 
out  in  January  1965  at  the  remote  test  site  in  Nevada.  This  was  an  important 
step  towards  predicting  potential  nuclear  incidents  of  interest  to  the  power 
reactor  safety  program.  The  confirmation  of  calculations  by  the  experimental 
results  obtained  in  this  excursion  has  placed  a  high  confidence  level  on  all 
nuclear  accident  predictions. 

It  was  particularly  hard  to  predict  the  energy  which  is  converted  from 
heat  energy  to  mechanical  energy  and  relate  this  to  chemical  explosives  or 
explosions  that  we  know  so  much  about. 

Characteristics  of  Explosions 

Kiwi-TWT  was  "exploded"  in  the  sense  of  a  violent  disruption  and  dis¬ 
persion  of  an  originally  intact  object.  In  no  way  did  that  explosion  resemble 
the  conventional  nuclear  detonation. 


51 


Physical  or  chemical  examples  that  might  be  used  for  comparison  are 
explosions  of  dust,  gas/air  at  atmospheric  and  elevated  presaurea,  entrapped 
liquefied  gases,  boilers,  high  explosives,  and  black  powder.  This  interesting 
safety  study  of  a  violent  reactor  excursion  ran  head-on  into  an  international 
political  complication. 

Although  planned  in  detail  for  several  years  and  widely  announced  as  a 
reactor  safety  experiment,  and  clearly  of  universal  interest  to  a  clean- 
power-needy  world,  it  nevertheless  was  a  power  excursion  that  had  exploaive-like 
physical  effects. 

In  1963  a  nuclear  bomb  test  ban  treaty  had  been  signed  by  three 
principal  nations:  United  States,  United  Kingdom  and  Union  of  .Soviet 
Socialist  Republics.  Before  long  a  total  of  105  nations  had  already 
subscribed  to  this  test  ban  treaty.  Article  1  of  the  Test  Ban  Treaty 
states: 

1.  Each  of  the  Parties  to  this  Treaty  undertakes  to  prohibit, 
to  prevent,  and  not  to  carry  out  any  nuclear  weapon  test 
explosion,  or  any  other  nuclear  explosion,  at  any  place  under  its 
Jurisdiction  or  control: 

(a)  in  the  atmosphere . 

2.  Each  of  the  Parties  to  this  Treaty  undertakes  furthermore  to 
refrain  from  causing,  encouraging,  or  in  any  way  participating 
in,  the  carrying  out  of  any  nuclear  weapon  test  explosion, 

or  any  other  nuclear  explo-jion,  anywhere  which  would  take 

place  in  any  of  the  environments  described .  in  paragraph  1 

of  this  Article. 
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While  I,  and  others ,  may  believe  that  the  purpose  of  this  treaty  was  to 
control  testing  of  nuclear  bombs,  or  bomb-like  devices,  nevertheless  the 
effects  of  the  reactor  excursion  described  were  clearly  contrary  to  the 
words  of  the  treaty. 

This  is  certainly  a  strong  reason  why  a  research  program  with  contrived 
similar  reactor  accident  situations  is  not  pursued.  Of  course,  there  are 
probably  many  other  valid  reasons. 

But  my  observations  on  the  public  acceptance  of  new  risk  leads  me  to 
conclude  that  an  understanding  of  the  nature  and  consequences  of  potential 
misadventure  may  be  as  important  as  an  accident-free  experience.  Too  often 
does  one  see  the  concept  of  "maximum  credible  accident"  become  like  the 
childhood  boast  of  "my  daddy  can  lick  your  daddy"  or  "I  can  figure  out  a 
credible  accident  more  maximum  than  yours."  Soon  it  is  the  credibility 
that  gets  strained  and  once  this  begins  it  is  like  yearning  for  the  super¬ 
fluous  -  without  limit  and  of  little  use. 

CONCLUSION 

With  the  increased  social  awareness  of  riBk  in  recent  years  has  been  the 
parallel  development  of  the  "prophets  of  doom."  These  are  the  individuals 
and  groups  who  view  science  and  technology  as  plunging  ahead,  guided  only  by 
their  own  internal  value  systems,  applying  new  knowledge  hastily  without 
regard  to  human  and  esthetic  consequences.  In  the  force  of  this  advance, 
according  to  the  usual  indictments,  the  individual  is  almost  helpless. 
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There  is  little  doubt  of  the  truth  in  the  accusation  that  science  and 
technology  have  introduced  nev  risks.  I  believe  it  is  equally  true  that 
there  has  been  a  historical  gain  in  safety  through  technical  changes. 

To  interrupt  thin  gain  by  a  demand  for  a  demonstration  of  absolute  safety 
would  be  a  tragedy  which  I  hope  we  could  avoid. 


ANALYTICAL  APPROACHES  TO  RISK  EVALUATION 


by 

Vernon  L.  Grose 
Vice  President 

T  tin  Institute  of  Technology 
Santa  Barbara,  California 


Mr.  Grose's  presentation  was  not  available  for  inclusion 
in  the  Proceedings.  However,  much  of  the  material  that  he 
presented  orally  is  included  in  the  attached  paper  which 
he  presented  in  April  1971  to  the  Rail  Transit  Conference. 
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SYSTEM  SAFETY  IN  RAPID  RAIL  TRANSIT 


Vernon  L,  Grose 


Every  rail  transit  concept  or  desigr.-  by  the  time  it  is  produced, 
c  'ntains  a  considerable  level  of  inherent  safety.  Good  engineering 
practice  always  includes  the  requirement  of  making  a  transit  system 
safe.  To  state  it  another  way,  a  competent  transit  system  designer 
would  find  it  more  difficult  to  deliberately  design  a  transit  system  to 
be  unsafe  than  he  would  to  make  it  safe. 

Therefore,  to  separate  "system  safety"  from  rail  transit  system 
design  is  a  difficult  ask.  And  it  may  be  thought  to  be  a  totally  unneces¬ 
sary  distinction!  T1  ise  who  understand  and  endorse  the  principle  of 
totally  integrated  d  esign  could  consider  it  most  inappropriate  to  isolate 
a  id  discuss  a  system  characteristic  such  as  safety.  Further,  it  could 
easily  appear  that  another  "cult;"  i.  e. ,  system  safety,  is  being  developed 
to  further  de-focus  the  already  diffused  responsibility  of  the  transit  system 
designer. 

Could  not  the  designer  ask  the  question,  "Am  I  to  design  the  transit 
system  without  consideration  of  safety  and  then  turn  it  over  f-  some 
expert  in  safety  to  make  it  safe?"  Why  not  simply  motivate  ..^e  designer 
to  be  more  cautious  and  conscious  of  safety  while  he  is  designing  if  we 
want  to  be  confident  of  safe  operation  of  the  transit  system?  Is  it  even 
possible  to  discuss  safety  of  a  transit  system  apart  from  the  sys-em 
itself  ? 

These  questions,  illustrating  the  difficulty  of  separating  safety 
from  good  solid  engineering  and  manufacturing  practice,  lend  credibility 
to  tiie  well-known  cliche,  "Safety  is  everybody's  business."  Unfortunately, 
safety  often  thereby  becomes  nobody's  business. 

If  system  safety  is  to  be  considered  a  separate  and  legitimate 
pursuit  in  the  development,  production  and  operation  oi  a  rapid  rail 
transit  system,  conclusive  answers  to  the  following  questions  appear 
mandatory: 
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1.  What  is  distinctly  unique  about  "system  safety"  apart  from  ?.ll 
other  transit  system  effort? 

2.  What  traditional  roles  and/or  activities,  if  any,  must  be  revised, 
augmented  or  tuolished  to  accomplish  "system  safety?" 

3.  Is  "system  safety"  a  technical  activity,  a  transit  system 
parameter  (like  cost  or  load  density),  an  organizational 
function  or  a  professional  occupation? 

4.  How  is  "system  safety"  achieved;  i.  e, ,  by  edict,  persuasion, 
activity,  organization  or  technique? 

5.  When  in  transit  system  development  is  "system  safety"  pursued; 
i.  e.,  during  conceptual  studies,  design,  development,  test, 
production  or  operation?  On  a  continuous  basis  or  sporadically? 

I  will  attempt  to  answer  these  questions  in  the  context  of  a  rapid 
rail  transit  system. 

SYSTEM  SAFETY  DEFINED 

The  term  "system  safety"  could  mean  to  some  people  that  industrial 
safety  had  "gone  modern"  and  substituted  the  adjective  system  for 
industrial.  That  would  be  a  most  unfortunate  assumption.  System  safety 
can  be  defined  as 

"the  optimum  degree  of  hazard  elimination  and/or  control  within 
the  constraints  of  operational  effectiveness,  time  and  cost, 
attained  through  the  specific  application  of  management, 
scientific  and  engineering  principles  throughout  all  phases  of 
a  system  life  cycle.  " 

In  the  largest  sense  of  the  word,  system  safety  embraces  all 
conceivable  interactions  of  operational  and  support  equipment,  personnel, 
facilities,  and  software  which  are  ured  together  as  an  entity  and  capable 
of  performing  and/or  supporting  a  mass  transit  role. 

System  safety  covers  the  total  spectrum  of  risk  management.  It 
goes  beyond  the  transit  vehicle  and  associated  operating  procedures. 

Its  scope  includes  attitudes  and  motivations  of  design,  production,  test 
and  operations  personnel,  employee /management  rapport,  the  relation 
of  industrial  and  labor  associations  among  themselves  and  with  the 
Government,  human  factors  in  supervision,  the  interfaces  of  industrial 
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and  public  safety  with  design  and  operations,  the  interest  and  attitudes 
of  top  management,  the  effects  of  the  legal  system  on  accident  investi¬ 
gations  and  exchange  of  information,  the  certification  of  critical  operating 
personnel,  political  considerations,  public  sentiment  and  many  other 
non-technical  but  vital  influences  on  the  attainment  of  an  acceptable  level 
of  risk  control. 

System  safety  could  also  be  considered  a  marriage  of  the  systems 
approach  with  safety  orientation.  The  "systems  approach"  was  developed 
in  a  rather  pragmatic  manner.  1  Eight  characteristics  of  this  methodology 
have  been  identified  as  basic  to  the  concept,^  These  characteristics  are 
likewise  basic  to  system  safety:  methodical,  objective,  quantitative  or 
measurable,  analytical,  dependent  on  subsystems,  elemental  analysis 
in  parallel  rather  than  series,  inputs/outputs  in  clear  language,  and 
self-containment. 

Is  system  safety  then  a  technical  activity,  a  rail  transit  system 
parameter,  a  transit  organizational  function  or  a  professional  occupa¬ 
tion?  It  is  all  four. 

System  Safety  as  a  Technical  Activity 

There  are  a  number  of  unique  technical  tasks  dedicated  solely  to 
the  achievement  of  rail  transit  system  safety.  These  tasks  are  generally 
analytical  in  nature.  Experience  has  shown  that  separate  identity  and 
performance  of  these  tasks  is  essential  for  proper  motivation  during 
design  and  balanced  emphasis  on  safety  during  transit  system  tradeoff 
studies. 

Typical  technical  activity  performed  solely  for  system  safety  is 
the  preparation  of  Fault  Tree  Analyses  wherein  extensive  knowledge  of 
the  system,  background  in  the  historv  of  previous  hazards,  analytical 
imagination  in  postulating  a  variety  of  system  responses  to  a  given 
hazard,  and  capability  in  preparing  logic  diagrams  are  all  required. 

A  Rail  Transit  Fault  Tree  for  passenger  fatality  is  included  to  show  the 
basic  logic  diagramming  used  in  this  type  of  analysis.  Note  the  use  of 
"or"  and  "and"  logic  gates  to  connect  events  which  ultimately  lead  to 
the  primary  undesired  event  {passenger  fatality). 

System  Safety  as  a  Rail  Transit  System  Parameter 

In  its  simplest  form,  a  rail  transit  system  can  be  considered  to 
consist  of  a  composite  of  equipment,  personnel,  facilities,  and  soft¬ 
ware  which  are  used  together  as  an  entity  to  transform  known  inputs 
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into  desired  outputs.  This  transformation  of  inputs  into  outputs  can  be 
accomplished  at  varied  levels  of  danger  or  risk.  So  a  rail  transit  system 
can  be  described  as  a  "safe"  system  just  as  it  could  be  described  as  a 
"fast"  or  "costly"  system.  Therefore,  just  as  top  speed  and  cost  are 
considered  transit  system  parameters,  so  safety  is  also  a  transit  system 
parameter. 

Another  proof  that  safety  is  a  transit  system  parameter  is  that  it 
is  often  traded  against  size,  cost  or  performance  in  system  tradeoff 
studies,  This  is  not  to  say  that  safety  is  as  measurable  a  parameter  as 
size  or  cost.  Nevertheless,  it  ust  be  considered  a  system  parameter. 

The  National  Transportation  Safety  Board  recently  urged  that 
safety  be  recognized  by  metro politan  transit  officials  as  a  system  param¬ 
eter.  In  this  context,  the  NTSB  also  recommended  that  MIL-STD-882^ 
be  adopted  as  a  guideline  for  transit  system  safety  activity. 

System  Safety  as  a  Transit  Organizational  Function 

Only  in  recent  years  have  separately  identified  system  safety  groups 
been  established  in  technological  organizations.  However,  this  separate 
designation  has  occurred  as  a  result  of  a  demonstrated  need  to  focus 
attention  organizationally  on  system  safety.  There  are  at  least  four 
reasons  why  a  separate  system  safety  organization  can  be  justified: 

1,  System  safety  requires  some  highly  specialized  technical 
skills  which  can  be  acquired  only  through  extensive  formal 
education,  training  and  experience.  These  skills  are  ssldom 
available  in  classical  line  organizations.  Also,  time  is 
generally  not  available  to  train  line  organization  personnel  in 
these  unique  skills. 

2,  The  development,  preparation  and  evaluation  of  system 
safety  planning  must  be  done  on  a  continuous  basis.  Line 

and  top  management  can  then  use  the  syatem  safety  organization 
as  its  "professional  worrier"  on  behalf  of  system  safety  and 
is  thereby  free  to  concentrate  on  its  primary  operations, 

3,  The  system  safety  organization  has  a  continuing  responsibility 
to  provide  service  and  counsel  to  all  line  organization  personnel 
on  system  safety  from  their  viewpoint  of  expertise, 

4,  Frequently,  the  system  safety  organization  performs  line 
organization  work  assignments  on  a  loan  basis  in  specialized 
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areas  of  capability  which  may  not  be  available  temporarily 
in  line  organizations. 

Although  the  number  of  personnel  assigned  to  a  system  safety 
organization  and  the  reporting  level  in  the  organizational  structure  for 
system  safety  may  both  var<p  widely  in  practice,  the  purpose  of  a 
separate  organizational  identity  for  system  safety  is  defeated  if  the 
organization  is  unable  to  maintain  the  proper  balance  of  safety  emphasis 
during  the  total  life  cycle  of  the  transit  system. 

System  Safety  as  a  Professional  Occupation 

Due  to  the  specialized  system  safety  skills  described  earlier, 
there  is  increase. 'g  interest  on  the  part  of  technical  personnel  in  a 
profession  of  system  safety.  Colleges  and  universities  now  offer  both 
undergraduate  and  graduate  degrees  in  this  field.  Other  indicators  of 
a  frofessional  status  such  as  specific  technical  literature  in  this  discipline 
lend  credence  to  the  idea  that  system  safety  is  and  will  continue  to  be  a 
profesrional  occupation. 

It  would  bv  a  mistake,  however,  to  assume  that  even  a  majority  of 
personnel  working  in  the  field  of  system  safety  would  necessarily  have 
to  be  professionals  in  that  discipline.  Sine*  system  safety  is  an  inter 
disciplinary  activity,  it  is  an  excellent  assignment  for  specialists  who 
have  been  narrow  in  their  outlook  to  broaden  their  perspective.  Therefore, 
those  who  staff  system  safety  organizations  should  give  serious  consider¬ 
ation  to  rotation  of  line  organization  personnel  into  system  safety  for  a 
reasonable  length  of  time  as  part  of  their  career  development  program. 

SYSTEM  SAFETY  ANALYTICAL  REQUIREMENTS 

Analysis  forms  the  backbone  of  system  safety  activity.  The  primary 
emphasis  in  system  safety  analysis  is  inductive  thought;  i.  e.,  reasoning 
from  particular  data,  facts  or  incidents  to  a  general  conclusion.  Deductive 
reasoning;  i.e.,  reasoning  from  a  known  principle  to  an  unknown  or  from 
the  general  case  to  a  specific  case,  is  also  employed  to  a  lesser  degree. 

The  ultimate  purpose  of  any  analysis  is  to  aid  the  reaching  of  a 
decision.  In  the  case  of  system  safety  analyses,  the  terminal  decision 
is  a  management  one--  "that  the  optimum  amount  of  elimination  and/or 
control  of  hazards  in  the  transit  system  has  been  reached."  To  enable 
management  to  conclusively  reach  such  a  highly  consequential  decision, 
the  system  safety  analyst  has  several  requirements. 
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Knowledge  of  the  Rail  Transit  System 

There  is  an  obvious  danger  that  system  safety  analyses  may  be 
attempted  without  adequate  knowledge  and  understanding  of  the  specific 
transit  system  of  interest.  Any  system  safety  analysis  can  be  no  better 
than  the  state  of  knowledge  that  the  analyst  possesses  of  the  transit 
system  under  consideration. 

Especially  in  the  early  stages  of  rail  transit  system  design, 
specific  and  current  system  information  is  likely  to  be  available 
exclusively  within  the  design  function  or  organization.  Therefore, 
acquisition  of  design  details  by  the  system  safety  analyst  may  be 
difficult  to  obtain.  Nevertheless,  the  analyst  is  obliged  to  become 
proficient  in  the  knowledge  of  design  if  his  analysis  is  to  be  useful 

Major  rail  transit  criteria  such  as  location  of  transit  tracks 
(especially  if  adjacent  to  conventional  railroads  or  public  highways), 
transit  train  speed  and  spacing  regulation,  and  inherent  train  car 
crashworthiness  (together  with  associated  escape  criteria)  have  obvious 
inherent  safety  implications.  Without  question,  the  tradeoffs  utilized 
to  reach  a  decision  for  these  criteria  should  include  system  safety 
considerations.  In  addition,  however,  far  more  subtle  and  extensive 
criteria  are  also  of  concern  to  the  system  safety  analyst.  He  looks  for 
possible  interrelationships  which  could  lead  to  hazards  between  such 
diverse  factors  as  train  acceleration/deceleration  rates  location  and 
intensity  of  station  lighting,  height  of  train  car  floor  above  track,  the 
length  of  the  train  operator's  shift,  and  the  minimum  track  switching 
cycle.  An  experienced  analyst  in  system  safety  is  well  aware  that 
hazards  are  more  likely  at  interfaces  between  subsystems  than  within 
any  given  subsystem  itself. 

During  the  conceptual  phase  of  rail  transit  system  design,  the 
analyst  can  acquire  knowledge  of  the  design  in  various  ways  including 
personal  contact  with  designers,  studying  specifications  and  working 
with  breadboards  and  mockups.  Another  excellent  source  of  design 
knowledge  is  the  functional  flow  block  diagram.  This  diagram  shows 
the  functional  interrelationship  of  all  elements  in  the  transit  system. 

It  defines  inputs  and  outputs  as  well  as  all  the  functions  that  the  transit 
system  will  perform. 

An  additional  aspect  of  transit  system  knowledge  that  is  essential 
for  system  safety  analysis  is  the  operational  environment  to  which  the 
transit  system  will  be  subjected  in  service.  This  operational  environ¬ 
ment  should  not  be  limited  to  the  natural  environments  such  as 
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temperature,  vibration,  acoustics,  and  humidity.  It  should  include  all 
functional  or  operational  aspects  of  the  environment  such  as  the  type  of 
person  who  will  maintain  the  transit  system,  the  number  of  hours  that 
the  train  can  be  expected  to  operate  without  maintenance,  the  types  of 
schedules  and  loads  expected,  and  the  anti- sabotage  devices  employed. 

Knowledge  of  Rail  Transit  Hazards 

The  system,  safety  analyst  must  not  only  be  aware  of  the  transit 
system  design  but  also  of  those  conditions  which  have  been  proven  by 
past  experience  to  be  hazardous  for  rail  transit.  Hopefully,  there 
exists  within  the  transit  agency  and/or  transit  system  contractor's 
files  a  library  of  historical  data  regarding  such  hazardous  conditions. 

aution  must  be  exercised  to  not  limit  the  consideration  of  hazards 
to  those  conditions  involving  only  hardware.  Figure  2  is  a  Venn  diagram 
which  depicts  the  interrelationship  of  man,  machine,  media,  and  manage¬ 
ment,  There  are  15  different  categories  in  that  diagram;  e.  g. ,  roan/media, 
machine /management,  media /man/machine /management,  etc.  Each  one 
of  the  categories  contains  numerous  transit  system  hazards  which  must 
be  either  eliminated  or  controlled.  To  illustrate  a  further  breakout  of 
categories  or  factors  for  hazards,  Figure  3  represents  another  approach 
to  stimulate  the  transit  system  safety  analyst  to  consider  as  many  sources 
of  hazards  as  possible.  Asa  warning,  it  should  be  obvious  that  Figure  3 
ignores  the  interaction  between  the  factors  listed,  e.  g. ,  possible  inter¬ 
action  between  passenger  vehicle  seat  versus  stand  ratio  and  accident 
investigation  procedures. 

The  technical  literature  on  system  safety  contains  many  excellent 
references  which  list  typical  hazardous  conditions.  These  listings  of 
hazards  should  be  consulted  by  the  system  safety  analyst  as  a  stimulant 
prior  to  and  during  his  analysis.  Very  few  accidents  or  incidents  are 
uniquely  new  or  first-time  events.  Almost  without  exception,  they  have 
happened  in  the  past  on  similar  equipment  or  in  similar  situations.  The 
concept  of  "known  precedent"  emphasizes  the  fact  that  once  an  accident 
cause  factor /potential  has  been  demonstrated  as  being  capable  of  causing 
an  accident,  it  can  be  expected  to  occur  with  a  given  frequency  and  in 
much  the  same  manner  as  errors  tend  to  perpetuate  themselves.  It  is 
the  dedication  to  precluding  the  repetition  of  previous  accidents  that 
stimulates  the  system  safet’"  analyst  to  consider  the  causative  factors  or 
conditions  of  the  past. 

Aside  from  the  now-pop..lar  trend  toward  referring  to  "noise"  as 
one  of  our  environmental  pollutants,  it  might  not  occur  to  someone  who 
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is  unacquainted  with  system  safety  that  "noise"  in  rapid  rail  transit 
systems  is  a  prime  source  of  hazards.  The  level  and  character  of 
noise  within  a  transit  car  are  dependent  on  numerous  factors  including: 
the  car  construction,  suspension  system,  wheels,  condition  of  the  car, 
type  of  track,  method  of  attachment  of  track  fastening,  trackbed,  speed 
of  the  car,  and  whether  the  car  is  travelling  along  straight  track  or 
moving  in  a  curved  path,  ^  These  factors  vary  in  importance  depending 
on  whether  the  train  is  in  a  subway  or  above  ground.  Because  sound  is 
an  important  sense  to  the  human,  "noise"  {a  specific  type  of  sound)  can 
induce  judgmental  errors  in  passengers  and  operators  as  well  as  cause 
physical  and  mental  sickness. 

Using  "noise"  as  a  simple  example  then,  it  should  be  evident  that 
any  system  safety  analysis  of  rail  transit  which  fails  to  list  hazards 
resulting  from  noise  would  fall  far  short  of  useful  in  assuring  hazard-free 
operation. 

Methodology  for  Analysis 

Once  the  system  safety  analyst  has  adequate  knowledge  of  the  rail 
transit  system  as  well  as  comprehension  of  possible  hazards  that  can  be 
associated  with  such  a  system,  he  is  ready  to  relate  these  two  bodies  of 
knowledge  via  a  logical,  methodical  process.  There  are  several  types 
of  analysis  for  system  safety  that  have  wide  usage.  Nevertheless,  these 
analyses  all  contain  certain  common  elements.  They  all  have  objective?:, 
some  focusing  mechanism  for  decision,  and  a  decision  point  or  conclr  3ion. 

Analytical  Objectives  -  As  mentioned  earlier,  all  svstem  safety 
analyses  must  lead  to  a  decision  that  the  optimum  amount  of  elimination/ 
control  of  hazards  in  the  rapid  rail  transit  system  has  been  reached. 

This  decision  implies  that  all  hazard  possibilities  have  beer  considered 
by  the  analyst.  This  objective  of  analysis,  therefore,  vdll  be  incomplete 
if  the  analyst  fails  to  use  his  imagination  and  insight  to  include  the  most 
remotely  possible  hazards  as  well  as  those  that  are  obvious. 

Designers  are  frequently  guilty  of  confusing  [  os  Bible  hazards  with 
probable  hazards,  thereby  closing  their  minds  to  a  large  of  number  of 
hazards  which  are  possible  though  improbable.  ThiB  group  of  frequently 
ignored  hazards  is  governed  by  Murphy's  Law,  r.  e, ,  "If  a  hazard  can 
hanpen,  it  ultimately  will  happen." 

Another  objective  of  analysis  is  to  provide  a  clearly  discernable 
rationale  which  can  be  objectively  evaluated  by  somer  ie  othe*.  than  ihe 
analyst.  If  this  objective  fails  to  be  met,  there  is  no  way  to  effectively 
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measure  the  influence  of  subsequent  design  changes  on  the  transit  system 
safety.  Further,  the  value  of  the  conclusions  reached  by  the  analysis  will 
be  solely  dependent  on  the  integrity  and  capability  of  the  analyst. 

Focusing  Mechanism  -  Obviously,  there  are  not  enough  resources 
in  any  specific  rapid  transit  project  to  eliminate  and/or  control  all  the 
possible  hazards  in  the  transit  system.  Therefore,  there  must  be  some 
method  for  screening,  ranking,  or  filtering  the  hazards  for  those  of  the 
highest  consequence  to  operation  of  the  transit  system.  This  ranking 
process  provides  transit  management  with  a  yardstick  which  is  focused 
on  the  safety  problems  of  greatest  magnitude.  Then  management  can 
concentrate  the  application  of  resources  on  those  specific  problems. 

One  practical  way  by  which  this  ranking  or  focusing  can  be  accom¬ 
plished  is  by  first  evaluating  all  hazardous  conditions  when  applied  to 
the  transit  system  and  classifying  the  severity  of  the  hazards.  Four 
hazard  levels  are  defined  and  established  in  MIL-STD-882  for  this 
purpose.  ^  These  four  categories  cover  the  spectrum  of  consequence 
from  negligible  to  catastrophic  situations. 

This  classification  is  only  the  first  step  in  the  focusing  process. 

Two  additional  measures  have  to  be  applied  before  top  management  can 
authorize  expenditure  of  resources  to  eliminate  and/or  control  the  hazards. 
The  first  of  these  two  is  the  probability  or  likelihood  of  the  hazard  occur¬ 
ring.  If  the  hazardous  condition  is  likely  to  be  very  prevalent,  action 
should  be  taken  by  management  to  eliminate  or  control  the  hazard  even 
if  the  hazard  level  of  severity  is  less  than  catastrophic. 

The  second  of  the  two  additional  parameters  is  the  amount  and  type 
of  resources  required  to  eliminate  or  control  such  hazards.  If  a  hazard 
can  be  reduced  or  eliminated  for  a  very  small  amount  of  money  or  effort, 
management  is  abliged  to  consider  this  hazard  even  if  it  is  of  relatively 
small  consequence  and  likelihood. 

In  summary,  then,  focusing  for  management  decision  is  accomplished 
by  simultaneously  considering  three  parameters  of  any  hazard: 

1.  The  consequence  or  severity  of  this  particular  hazard,  if  it 
occurs  during  the  operation  of  the  transit  system. 

2.  The  likelihood  or  probability  of  this  hazard  occurring. 

3.  The  amount  and  type  of  resources  required  to  eliminate  or 
control  this  hazard. 
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A  range  of  values  for  these  three  parameters  is  listed  in  Tables  1,  2, 
and  3, 


Table  1  is  an  example  of  how  the  four  hazard  levels  of  MIL-STD-882 
should  be  specifically  interpreted  for  a  particular  rapid  rail  transit  system. 
Note  that  each  hazard  level  must  be  interpreted  in  terms  of  system 
objectives,  functional  capability  and  personnel  safety.  All  possible 
hazards  in  the  transit  system  must  be  measured  for  severity  against 
these  four  hazard  levels,  and  one  of  the  four  code  letter  s  in  Table  1 
must  be  assigned  to  each  hazard. 

Table  2  provides  a  range  of  probabilities  for  any  given  hazard 
occurring.  The  same  procedure  used  in  selecting  a  code  letter  from 
fable  1  is  used  to  select  a  code  letter  in  Table  2,  with  every  possible 
hazard  also  being  assigned  one  of  the  four  probability  code  letters. 

Table  3  cannot  be  as  readily  applied  as  Tables  1  and  2  because 
there  must  be  an  intermediate  conversion  of  various  resources  (e.  g. , 
policy,  procedures,  manpower,  technology,  facilities,  materials,  and 
schedule)  into  a  dollar  equivalence  before  a  code  letter  can  be  selected. 
Nevertheless,  it  is  imperative  to  estimate  the  amount  of  resources  that 
will  be  required  to  eliminate/control  every  possible  hazard.  Therefore, 
a  third  code  letter  from  Table  3  must  be  assigned  to  each  hazard  under 
consideration 

Once  three  code  letters  {one  each  from  Tables  1,  2,  and  3)  have 
been  assigned  to  each  possible  hazard,  the  focusing  is  achieved  by 
combining  the  three  individual  code  letters  into  one  overall  index  of 
significance.  The  Hazard  Totem  Pole  of  Table  4  lists  these  code 
combinations  in  order  of  importance  or  significance  for  management 
decision. 

Decision  Point  -  When  all  possible  hazards  in  the  rapid  rail 
transit  system  have  been  focused  or  ranked  for  significance  in  a  Hazard 
Totem  Pole,  the  stage  is  set  for  management  decision  concerning  the 
hazards.  Obviously,  there  are  never  enough  resources  to  completely 
eliminate  every  possible  hazard.  For  this  reason,  management  must 
set  a  "decision  point"  or  cutoff  level  in  the  Hazard  Totem  Pole,  This 
decision  point  is  drawn  at  that  significance  ranking  code  below  which 
all  remaining  hazards  will  be  ignored.  The  decision  point  may  be 
established  by  either  (1)  the  reduction  of  hazard  significance  to  a  level 
which  management  considers  adequate  cr  {2)  the  depletion  of  resources 
available  for  application  to  hazard  elimination  or  control. 


68 


n) 

4>  S 
T3  jd 

U  <0  ® 
«  «  4> 

?  s  1 

«  .3 

fl  w 
g  « 
o  H 


U/  —  , 

ft  f,  A 


v  'a 

ts  .s  „ 

s.y  6 

.  “  >  A 
s  ® 

*  x>  .5  s 

m 

*  *0  fcyD 

£  .S  •" 

o  .o  a 

CL  *v 

'  OQ  2*  ^ 

fliu 

(3.4) 

M  £  43 
O  4J 


■  n  n 

i  "»  .2 

H  -U>  -U 

«  -g  3 
^  ei  c 
o  m  o 

■zh  ° 


. 

0 

o> 

u 

d 

M 

0 

VH 

2  rt 

CO 

(H 

0 

a  u 

CO 

0 

2 

CO 

s  1 

H 

H 

0 

S 

CL  4_i 

d 

0 

•u 

_  “ 
0 

4-» 

O 

* 

CO 

>* 

2;  to 

H 

H 

CO 

«  c 

css 

rt  m  .h 
^  " 
"  g  -S 

<u  ®  c 

^  u  o 

0  O  o 

C  c  " 
o  5  ,a 
2  cH 


Slg 

B  'i  O 

o  3  a 

o. -g  flt 

!»  Lj 
®  >  « 

<4  a 
•t!  bo  0 
«  c  -u 
c  -g  c 

2  3-3  • 

-  3  s  § 

3  3  I  s 

™  >.  v  a. 
K  JO  u  o 


jo  - 

<4  .7} 

£  3 
a  w 
«  c  H 

<4  o  C 
«i  o 
:  «  >h 
£  o  co 
*  4)  <n 

o  sa  -a 
z  4)  g 


0 

3 

a 

0 

**■4 

0) 

(4 

H 

d 

3 

JQ 

CO 

0 

.3 

60 

M 

(4 

So 

JS 

d 

a 

•H 

a 

0 

U 

2 

d 

2 

«; 

« 

u 

Q 

Table  2 


HAZARD  PROBABILITY  FOR  RAIL  TRANSIT  SYSTEM 


CODE 

DESCRIPTION  OF  SITUATION 

J 

Hazard  of  interest  wd  crorr  within  10  cumulative  hours 
of  operation 

K 

Hazard  of  interest  will  occur  within  100  cumulative  hours 
(4  cumulative  days)  of  operation 

L 

Hazard  of  interest  will  occur  within  1000  cumulative  hours 
(41  cumulative  days)  of  operation 

M 

Hazard  of  interest  will  occur  within  10,000  cumulative 
hours  (14  cumulative  months)  of  operation 

Table  3 

HAZARD  ELIMINATION/CONTROL  RESOURCES 


CODE 

CALCULATED  DOLLAR  EQUIVALENCE 

P 

Less  than  $1000  required  to  eliminate /control  this  hazard 

Q 

$1000  -  10,000  required  to  eliminate/control  this  hazard 

R 

$10,000  -  100,000  required  to  eliminate /control  this  hazard 

S 

Over  $100,000  required  to  eliminate/control  this  hazard 

♦Calculated  dollar  value  of  all  resources  (revision  of  policy, 
procedures,  manpower,  dollars,  technology,  facilities,  materials, 
and  schedule)  required  to  either  ..liminate  or  control  the  hazard  of 
interest. 
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Table  4 


HAZARD  TOTEM  POLE 


^Because  there  are  4  codes  for  each  of  the  3  hazard  parameters,  the 
Hazard  Totem  Pole  must  contain  64  code  combinations;  i.  e. ,  4x4x4, 

The  ordering  or  ranking  of  the  code  combinations  in  this  example  is 
such  that  the  first  combination  (AJP)  is  the  most  significant  and  code 
combination  DMS  is  least  significant  to  rail  transit  system  management. 
This  ordering  can  be  varied  depending  on  the  criteria  one  sets  for 
relative  significance  between  hazard  severity,  probability  and  resources. 
In  the  ordering  illustrated,  all  three  parameters  were  equally  weighted 
but  preference  was  given  first  to  severity,  then  probability  and  finally 
resources.  Both  weighting  and  preference  of  codes  should  be  established 
prior  to  preparing  a  Hazard  Totem  Pole. 

The  codes  being  combined  are  those  from  Tables  1,  2,  and  3, 
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To  illustrate  this  decision  point,  management  could  decide  that  it 
will  eliminate  and/or  control  all  hazards  in  the  first  7  levels  or  categories 
in  the  Hazard  Totem  Pole  shown  in  Table  4;  i,e,,  all  the  AJP,  AJQ,  AKP, 
BJP,  AJR,  AKQ,  and  ALP  hazards.  This  would  mean  that  31  specific 
identified  hazards  will  require  resources  to  be  allocated  by  management 
for  purposes  of  eliminating  or  controlling  the  hazards,  (Note  that  there 
were  no  AJQ  or  AKQ  hazards,) 

It  is  important  to  also  note  that  while  management  will  be  commit¬ 
ting  resources  for  the  first  7  levels  in  the  Hazard  Totem  Pole,  they  will, 
by  this  very  action,  be  deliberately  ignoring  all  remaining  57  levels  in 
the  Hazard  Totem  Pole,  Therefore,  the  decision  point  in  system  safety 
analyses  is  that  point  which  separates  action  from  inaction  regarding 
hazards. 

RESOLUTION  OF  HAZARDS 


The  pr  imary  purpose  of  the  system  safety  concept  is  to  consider 
the  elimination  of  hazards  in  the  rapid  rail  transit  system  during  the 
design  phase,  thereby  precluding,  in  the  most  economic  manner,  loss 
of  life  and  property.  While  the  analytical  effort  discussed  thus  far  must 
precede  design  integration  of  system  safety,  it  is  only  preparatory. 
Analysis,  per  se,  cannot  accomplish  any  increase  in  the  safety  of  the 
transit  system. 

Assuming  then  that  a  thorough  system  safety  analysis  of  the  transit 
system  design  has  been  performed,  that  a  Hazard  Totem  Pole  ha3  been 
prepared,  and  that  engineering  management  has  established  a  decision 
point  in  the  Hazard  Totem  Pole,  the  actual  effort  toward  achievement  of 
system  safety  can  begin. 

The  first  step  in  the  achievement  of  system  safety  must  be  taken 
by  the  transit  system  designer.  He  must  resolve  whether  he  is  going  to 
totally  eliminate  the  possibility  of  each  hazard  or  whether  he  will 
institute  control  measures  in  the  design  to  assure  that  such  hazards  can 
be  tolerated  by  the  transit  system, 

MIL-STD-882  describes  a  series  of  actions  for  satisfying  safety 
requirements  of  a  system  design.  The  series  is  known  as  "system  safety 
precedence."  This  precedence  is  shown  in  logic  diagram  format  in 
Figure  4. 

The  first  and  most  desirable  alternative  (#1  in  Figure  4)  is  to 
eliminate  the  identified  hazard  completely  by  means  of  appropriate  safety 
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design  features  such  as  fail-safe  or  redundant  approaches.  If  elimination 
of  a  hazard  is  impossible  or  uneconomical,  the  next  step  is  to  make  the 
transit  system  tolerant  to  the  hazard.  This  can  be  done  knowingly  or 
unknowingly.  However,  system  safety  methodology  demands  that  hazard 
tolerance  be  knowingly  designed  into  the  transit  system  if  the  hazard 
cannot  be  eliminated. 

Three  alternatives  for  making  a  design  tolerant  to  identified 
hazards  are  stipulated  in  MIL-5TD-882  in  a  descending  order  of  desir¬ 
ability.  The  first  of  these  accommodative  approaches  to  hazards 
(#2  in  Figure  4)  is  to  reduce  the  significance  of  the  hazard  through  the 
use  of  appropriate  safety  devices.  These  devices,  placed  at  critical 
junctures  in  the  transit  system,  should  not  require  human  intervention 
or  cognizance  but  should  operate  automatically  if  the  specified  hazardous 
condition  arises.  An  example  of  this  approach  might  be  the  application 
of  collision-avoidance  radar  on  trains  which  would  automatically  sense 
the  closing  rate  between  two  trains  (without  involvement  of  an  operator) 
and  apply  brakes  in  adequate  time  to  prevent  collision. 

The  next  choice  shown  in  Figure  4  that  should  be  considered  (#3) 
is  to  accommodate  the  occurrence  of  an  identified  hazard  by  placing 
warning  devices  at  those  points  in  the  transit  system  which  are  susceptible 
to  that  hazardous  condition.  These  devices  would  obviously  require  human 
intervention  to  respond  to  the  warning  produced  by  the  device.  Audio  or 
visual  indicators  are  commonly  used  in  this  respect,  but  there  is  a  limit 
on  the  number  of  such  devices  that  can  be  effectively  employed  in  complex 
situations. 

The  final  and  least  desirable  approach  to  satisfying  requirements 
for  safety  in  the  transit  system  is  to  prepare,  disseminate,  and  enforce 
special  operating  procedures  regarding  the  identified  hazardous  condition. 
Procedures  are  to  be  viewed  as  a  weak  link  in  the  achievement  of  system 
safety  because  of  the  inability  to  verify  the  communication  of  the  procedure 
to  the  person  v/ho  must  operate  in  accordance  with  it. 

With  the  exception  of  those  hazards  which  can  be  eliminated  very 
economically  early  in  the  design  stage,  the  four  possible  alternatives 
shown  in  Figure  4  are  numbered  in  a  hierarchy  of  decreasing  effective¬ 
ness  as  well  as  decreasing  cost.  Therefore,  the  lower  the  number  in 
the  hierarchy,  the  more  effective  the  choice  will  be  in  satisfying  transit 
system  safety  requirements  even  though  there  may  be  higher  cost 
associated  with  the  action. 

Figure  4  also  illustrates  that  the  transit  system  design  can  be 
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tolerant  to  identified  hazards  without  the  knowledge  of  either  designers 
or  operators.  This  area  of  ignorance  about  the  hazard  tolerance  is  not 
desirable  and  is  therefore  shown  in  dotted  lines. 

A  third  possibility  for  identified  hazards  is  that  the  transit  system 
can  be  intolerant  to  such  hazards.  This  is  a  vital  area  of  system  safety 
concern  and  attention.  As  shown  in  Figure  4,  transit  system  intolerance 
to  a  particular  hazard  may  occur  eitner  with  the  cognizance  of  those  who 
design,  build  and  operate  the  system  or  in  their  ignorance.  Hazards  to 
which  a  transit  system  is  knowingly  intolerant  are  commonly  described 
as  "accepted  risks"  and  should  be  among  those  hazards  that  fall  below 
the  decision  point  in  the  Hazard  Totem  Pole. 

CONCLUSIONS 

To  briefly  summarize  this  paper,  the  five  questions  postulated  in 
the  introduction  could  be  answered  as  follows: 

1.  What  is  distinctly  unique  about  "system  safety"  apart  from  all 
other  transit  system  effort? 

Answer:  It  is  a  professional  activity,  free  from  the  pressures 
of  line  organization  and  solely  dedicated  to  "worrying"  about 
hazards,  real  and  potential,  that  could  prevent  the  transit 
system  from  accomplishing  its  full  and  intended  mission. 

2.  What  traditional  roles  and/or  activities,  if  any,  must  be  revised, 
augmented  or  abolished  to  accomplish  "system  safety?" 

Answer:  First,  the  "system"  aspect  of  system  safety  demands  a 
revision  in  planning  and  management  by  insisting  on  a  "womb-to- 
tomb"  viewpoint  from  the  very  outset  of  system  design.  Second, 
by  covering  the  total  spectrum  of  risk  management,  system  safety 
embraces  not  only  the  concept  of  "freedom  from  danger"  but  also 
"freedom  from  loss  of  any  resource." 

3.  Is  "system  safety"  a  technical  activity,  a  transit  system 
parameter  (like  cost  or  load  density),  an  organizational 
function  or  a  professional  occupation? 

Answer:  It  is  all  four. 
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4,  How  is  "system  safety"  achieved;  i.e,,  by  edict,  persuasion, 
activity,  organization  or  technique? 

Answer:  Depending  on  when  in  the  life  cycle  of  the  transit 
system  it  is  instituted,  system  safety  will  exhibit  one  of  these 
methods  to  a.  greater  extent  than  the  rest.  However,  it  would 
be  accurate  to  say  that  all  five  methods  are  utilized  to  some 
extent  in  any  system  development  and  operation. 

5.  When  in  transit  system  development  is  "system  safety"  pursued; 

i.e.,  during  conceptual  studies,  design,  development,  test, 
production  or  operation?  On  a  continuous  basis  or  sporadically? 

Arswer:  The  earlier  that  system  safety  emphasis  and  activity 
occurs,  the  higher  the  safety  is  likely  to  be  per  dollar  invested. 
System  safety  activity  should  ideally  occur  in  all  phases  of 
system  life,  from  conception  to  retirement.  The  effort  should 
continuous,  not  necessarily  at  the  same  level  of  effort,  through 
the  entire  life  cycle  of  the  transit  system. 
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DECISION  RISK  ANALYSIS 


Risk  Theory 
by 

Jerome  H.  N.  Selman 

This  paper  presents  a  conceptual  framework  applicable  for  i 
identifying  and  quantifying  the  risk  elements  in  the  transpor¬ 
tation  of  hazardous  materials.  The  primary  aim  of  Decision 
Risk  Analysis  is  to  prescribe  how  a  decision  maker  should 
choose  among  alternate  courses  of  action  when  the  outcomes  of 
such  a  choice  depend  on  events  that  are  not  known  with  certainty. 
Decision  Analysis  which  is  variously  defined  as  a  methodology 
for  analyzing  complex  decision  problems,  a  way  of  formalizing 
common  sense,  a  theory  of  rational  behavior  in  the  face  of 
uncertainty-- -has  grown  from  a  mathematical  toy  to  an  important 
aid  of  the  decision  maker.  Ronald  A.  Howard  of  Stanford 
University  predicts  that  "in  the  future  both  technical  and 
managerial  decision  makers  will  employ  formal  logical  methods 
in  decision  making.  The  transition  probably  will  be  painful." 

The  innovation  of  Risk  Analysis  is  the  professional 
presentation  to  the  decision  maker  of  models  of  the  system 
which  permit  him  to  input  his  own  personalistic,  subjective  or 
intuitive  judgments  into  the  analytical  or  quasi-analytical 
structure  to  arrive  at  credible  decisions  in  which  he  feels 
confident. 

From  the  point  of  view  of  the  decision  maker,  the  program 
that  has  been  risk-analyzed  should  hare  no  surprises.  The 
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Risk  Analysis  should  have  addressed  all  critical  areas,  it 
should  have  raised  all  sorts  of  embarrassing  questions,  like 
the  "Devil's  Advocate"  of  the  Jesuits  who  assembled  the  best 
negative  arguments.  If  the  proposal  cannot  withstand  such  an 
attack  as  a  test  of  the  decision,  action  is  postponed.  The 
devil's  advocate  is  not  passing  judgment  on  a  program,  but 
simply  seeing  to  it  that  all  adverse  point*  are  considered  in 
a  responsible  manner. 

A  working  definition  of  Risk  Analysis  might  be  "a  systems 
analysis  (approach)  to  risk"  which  implies  that  the  goal  is 
to  identify  the  risk  areas,  reduce  or  eliminate  the  risks, 
improve  the  chances  of  successful  accomplishment  of  the  mission. 
In  the  Department  of  Defense  the  term  means  the  identification 
of  the  uncertainties  involved  with  the  time  (schedule)/cost/ 
technical  performance  (quality)  measures  of  the  system. 

Decision  Risk  Analysis  is  the  method  whereby  the  uncertainty 
measures  of  three-dimensional  space  are  traded  off  to  find  an 
optimal,  or  satisfactory  alternative.  The  output  of  decision 
analysis  is  a  quantitative  assessment  of  which  alternative(s) 
should  be  selected.  A  number  of  techniques  of  Operations 
Research,  Systems  Analysis,  Management  Science,  are  normally 
used  in  forming  a  decision  analysis  model  of  a  complex  system. 
The  Delphi  procedures  (for  group  consensus  of  experts)  and  the 
Standard  Gamble  or  Lottery  technique  are  often  used  for 
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encoding  judgment  into  (subjective)  probability  distributions 
associated  with  uncertain  outcomes  for  3-space.  The  Decision 
Tree  technique  is  a  useful  schematic  summary  for  structuring 
and  evaluating  the  alternatives  appropriate  to  a  set  of 
circumstances  involved  with  a  sequence  of  decisions  required 
for,  say,  the  transportation  of  dangerous  goods.  A  "tree"  is 
constructed  by  enumerating  and  tracking  through  from  start  to 
finish  the  outcomes  of  each  possible  decision  that  can  be 
made  at  decision  points  along  the  way.  The  payoff  of  each 
route  (branch,  sequence  of  decisions)  through  the  tree  is 
calculated  along  with  the  system  risk  in  3-space.  Probability 
theory  and  utility  theory  are  used  to  tie  this  all  together 
and  determine  the  expected  project  payoff  and  associated  risk. 

Risk  is  ubiquitous.  The  precise  definition  is  dependent 
upon  the  orientation  of  the  disciple  under  focus  —  economics, 
statistics,  business,  or  in  the  common  vernacular.  Risk  levels 
are  difficult  to  assess.  For  airline  insurance,  for  example, 
is  $1.00  premium  for  a  $40,000.00  principal  sum  (for  a  one-way 
trip)  reasonable,  or  exorbitant?  Does  the  fact  of  one  fatality 
per  5  million  air  trips  have  any  physical  or  probabilistic 
meaning  on  making  a  decision? 

A  sharp  distinction  should  be  'ade  between  decisions  and 
outcomes  in  the  decision  process.  A  good  outcome  is  a  desirable 
outcome.  A  good  decision  is  one  logically  consistent  with 
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information  and  preferences.  The  purpose  of  Decision  Risk 
Analysis  is  to  increase  the  likelihood  of  good  outcomes  by 
making  good  decisions. 

Some  assertions  concerning  Decision  Risk  Analysis  were 

made  by  R.  A.  Howard,  including  the  decision/outcome  dichotomy. 

The  current  trend  is  to  place  the  blame/praise  where  it  should 

properly  belong- --on  the  decision  process,  not  on  the  outcome. 

Much  attention  has  been  given  recently  in  the  Department 

of  Defense  to  the  nature  of  risk  in  evaluating  major  programs, 

as  it  has  become  increasingly  clear  that  the  methods  and 

practices  used  in  the  acquisition  and  control  of  systems  and 

programs  have  accounted  very  poorly  for  risks.  Due  to  the 

cost  growth,  time  growth  and  performance  degradation  upon 

major  weapons  systems,  the  Aerospace  Industries  Association 

stated  a  need  for  more  formal  methods  of  risk  assessment.  On 

31  July  1969,  Deputy  Secretary  of  Defense  David  Packard  wrote 

to  the  Secretaries  of  the  Army,  Navy,  and  Air  Force:  "I  would, 

therefore,  like  each  of  you  to  assure  that: 

Areas  of  high  risk  are  identified  and  fully  considered; 
Formal  risk  analysis  on  each  program  is  mad*: 

Summaries  of  these  are  made  part  of  the  buck-up  material 
for  the  program.” 

He  later,  on  28  May  1970,  offered  guidance  on  how  risks  inherent 

in  new  programs  can  be  minimized: 

1.  RISK  ASSESSMENT.  Make  a  careful  assessment  of  the 
technical  problems  involved  and  a  judgment  as  to  how  much 
effort  is  likely  to  be  necessary  in  finding  a  solution 
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that  is  practical.  A  careful  look  at  the  consequence  of 
failure,  even  of  'low  Tisk'  program  elements,  is  also 
critical . 

2.  SYSTEM  (5  HARDWARE)  PROOFING.  Perform  enough  actual 
(eng)  design  and  component  testing  in  the  conceptual 
development  stage  to  demonstrate  that  the  technical  risks 
have  been  eliminated  or  reduced  to  a  reasonable  level. 
Component  or  complete  system  prototyping,  or  back-up 
development,  are  examples  of  this.  Pilot  studies, 
feasibility  studies  of  competing  approaches  are  other 
examples . 

3.  TRADE-OFFS  (RISK  AVOIDANCE) .  Consider  trade-offs  not 
only  at  the  beginning  of  the  program  but  continually 
throughout  the  development  stage;  program  risk  and  cost 
are  dependent  on  practical  trade-offs  between  stated 
operating  requirements  and  engineering  design. 

Of  the  three  groups  of  professional  decision  makers  — 

business  executives,  politicians,  and  military  officers--- 

only  the  military  have  a  formal  doctrine  of  decision,  known 

as  "the  estimate  of  the  situation."  Its  five  formal  steps  are: 

•  Determination  of  the  mission. 

•  Description  of  the  situation  and  courses  of  action. 

•  Analysis  of  opposing  courses  of  action. 

•  Comparison  of  own  course  of  action. 

•  The  decision. 

However,  due  to  the  limited  applicability  to  two-person 
situations  (e.g.,  battlefield  problems),  even  military  decisions 
are  made  with  that  intangible  something  known  as  military 
judgment,  just  as  business  decisions  are  made  with  business 
judgment . 
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Businessmen  are  remarkably  candid  about  their  own  inability 

to  analyze  the  act  of  decision.  In  a  1955  survey  by  Fortune 

as  to  how  businessmen  make  decisions,  no  rules  were  indicated: 

Cox  (President,  Kennecott  Copper):  I  don’t  think 
businessmen  know  how  to  make  decisions.  I  know  I  don't! 

Fairless  (ex-Chairman,  U.  S.  Steel):  You  don’t  know  how 
you  do  it,  you  just  do  it. 

McCaffrey  (President,  International  Harvester):  It’s  like 
asking  a  professional  baseball  player  to  define  the  swing 
that  has  always  come  natural  to  him. 

A  surprising  number  of  executives-- -perhaps  of  the  dynamic 

(vectoral)  type  of  Professor  John  Mihalasky  in  his  talk  on 

Precognition  in  Decision  Making — believe  that  the  outcome  of 

their  decisions  is  certainty. 

Gilbert  (President,  Seattle  Gas  Co.):  It  sounds  bad  in 
print,  but  I  am  always  sure  of  the  results  when  I  make 
an  important  decision. 

Other  decision  makers  talk  about  risk: 

Willkie  (President,  Pacific  American  Fisheries):  Very 
few  things  are  black  and  white;  mostly  grey.  I  don't 
consider  certainties  ever.  But,  certainly,  I  consider 
the  good  probabilities.  I'd  say,  .300  is  a  good  batting 
average  in  our  business. 

Doan  (President,  Dow  Chemical):  I  estimate  15  plus 
percent  error  occurs  in  the  best  decisions. 

The  latest  current  guidelines  on  decision  risk  analysis 

offers  the  following  advice  which  is  quite  similar  to  the 

procedures  for  systems  analysis,  for  the  military  "estimate" 

of  a  situation"  and  more  generally,  the  scientific  method: 
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1.  Define  just  what  the  problem  is  (this  may  be  a  major  effort 
in  some  instances) . 

2.  Establish  alternat ' * es  with  their  appropriate  terminal 
milestones.  (It  is  i;.ioortant  to  ferret  out  all  possibilities. 

An  alternative  should  not  be  ignored  because  it  does  not 
appear  to  be  a  likely  future  choice.) 

3.  Lay  out  all  the  possible  chain  of  events  leading  to  the 
terminal  milestone  for  each  alternative. 

4.  Determine  the  possible  outcomes  at  the  terminal  milestone 
for  each  alternative  in  terms  such  as  time,  cost,  and/or 
performance . 

5.  Assess  the  probability  of  achieving  each  of  these  outcomes. 
(One  should  place  emphasis  on  quantifying  the  uncertainty  in 
those  events  shown  by  sensitivity  analyses  to  be  driving  forces. 
This  effort  may  be  facilitated  by  developing  probabilistic 
performance  models  relating  component  performance  to  overall 
performance  and  utilizing  certain  computer  models  which  relate 
total  time  and  cost  distributions  associated  with  the  terminal 
milestone  to  the  time  and  cost  distributions  of  events  leading 
to  the  terminal  milestone.) 

6.  Conduct  trade-off  analyses  to  provide  the  basis  for 
selecting  a  preferred  alternative. 
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7.  Determine  the  sensitivity  of  this  selection  to  variations 
in  trade-off  criteria  and  sensitive  events. 

8.  Present  the  final  study  to  the  decision  maker  in  a  concise 
logical  fashion  emphasizing  the  rationale  behind  the  selection 
of  the  preferred  alternative.  (It  is  important  to  highlight 
the  events  to  which  the  outcome  of  each  alternative  is 
sensitive.) 

The  idea  is  to  make  the  network  exhaustive  in  the  sense 
that  all  feasible  alternative  paths  or  outcomes  are  identified 
and  listed;  the  tree  can  then  be  pruned  in  a  heuristic  manner 
so  that  only  realistic  (practical)  alternatives  remain.  Values 
as  well  as  probabilities  can  be  input  to  the  structure  so  that 
the  decision  maker  (via  sensitivity  analysis)  can  see  the 
impact  of  changes  in  the  variables.  After  all  the  hocus-pocus 
of  manipulating  the  decision  tree  model,  the  decision  to  be 
made  is  clear.  For  example,  to  select  alternative  X  would  be 
equivalent  to  taking  a  chance  on  a  (roulette)  wheel  where  the 
probability  of  success  is,  say,  801  and  failure,  201.  The 
question  then  becomes — who  will  make  that  decision?  Who  is 
the  decision  maker? 
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RISK  ANALYSIS 

(“SYSTEMS  ANALYSIS  OF  RISKI") 

IDENTIFIES: 

•  ANTICIPATED  PROBLEM  AREAS 

•  CONSEQUENCES  OF  FAILURE 

•  LOW  AND  HIGH  RISK  PROGRAM  AREAS 

•  REQUIREMENTS  VIS-A-VIS  STATE-OF-ART 

•  ADEQUACY  OF  TIME  FOR  PROGRAM 
Q  SUFFICIENCY  OF  BUDGET 

•  OPTIMUM  ALLOCATION  OF  RESOURCES 

•  DATA  GAPS 

©  NEEDED  STUDIES  AND  CONCEPTS 

•  SENSITIVE/CRITICAL  FACTORS 
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BASIC  SCHEME  FOR  RISK  ANALYSIS 
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EXAMPLE  OF  A  DECISION  TREE 


DECISION  RISX  ANALYSIS: 


Problems  In  Practice 


by 

John  Mihalasky 

sistant  Chairman,  Graduate  Courses 
Newark  College  of  Engineering 
Newark,  New  Jersey 


INTRODUCTION' 


A  decision  is  loosely  defined  as  a  choice  between 
alternatives,  that  results  in  an  allocation  of  resources  - 
money,  men,  time,  etc.  There  are  good  decisions  -  good  in  the 
sense  that  they  were  logically  made.  On  the  other  hand,  there 
are  also  good  outcomes.  The  assumption  is,  of  course,  that  a 
good  decision  will  lead  to  a  good  outcome. 

Decisions  are  made  from  the  consideration  of  objective 
data  classed  as  certainties,  and  objective  and  subjective  data 
classed  as  uncertainties.  The  manager  -  using  the  word  in  its 
broadest  sense  -  is  constantly  faced  with  the  integration  of 
uncertainties  with  certainties,  to  make  his  decision. 

The  manager  is  thus,  by  profession,  a  decision  maker, 
and  is  constantly  faced  with  the  integration  of  certainties  with 
uncertainties.  However,  this  professional  decision  maker  is  very 
frank  about  his  inability  to  explain  and  analyze  his  act  of  decision. 

Decision  Risk  Analysis  is  a  logical  procedure  for  con¬ 
sidering  and  assessing  these  factors  that  influence  the  decision. 

This  approach  makes  use  of  the  uncertainties,  as  well  as  certain¬ 
ties,  in  a  decision  model.  Ronald  Howard,  in  his  paper  "Decision 
Analysis  -  Applied  Decision  Theory,"  presented  the  Decision  Risk 
Analysis  (D.R.A.)  process  in  the  tabular  form  shown  below: 

TABLE  I 


1.  Deterministic  Phase. 

1.  Define  the  decision 

2.  Identify  the  Alternatives 

3.  Assign  values  to  outcomes 

4.  Select  state  variables 

5.  Establish  relationship  at  state  variables 

6.  Specify  time  preference. 

Analysis:  a)  Determine  dominance  to  eliminate  alternatives 
b)  Measure  sensitivity  to  identify  crucial 
state  variances. 

2.  Probabilistic  Phase. 

1.  Encode  Uncertainty  on  crucial  state  variables 
Analysis:  Develop  profit  lottery. 

2.  Encode  risk  preference 
Analysis:  Select  b-3t  alternative. 
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3.  Post  Mortem  Phase. 


Analysis;  a)  Determine  value  of  eliminating 

b)  Develop  most  economical  information 
gathering  program 

from:  Howard,  R.  A. Decision  Analysis  -  Applied  Decisions  Theory" 


G.I.G.O.  GARBAGE  IN  GARBAGE  OUT 


The  analysis  of  the  D.R.A.  procedure  reveals  that  the 
key  element  of  the  approach  is  data.  The  success  or  failure  of 
the  procedure  is  dependent  upon  the  data  used. 

To  begin  with,  data  are  often  difficult  to  obtain.  They 
are  not  readily  available,  and  thus  have  to  be  "dug  up"  and  tailored 
for  the  D.R.A.  In  addition  to  the  data  being  unavailable,  they 
may  be  available  but  hard  to  get  at.  Possessors  of  data  or  the 
knowledge  base  to  generate  data  are  reluctant  to  produce  data. 

They  may  be  afraid  to  part  with  the  data  for  fear  that  they  will 
be  later  used  as  a  standard  or  measuring  stick  to  assess  their 
own  work  performance. 

Inaccuracies  can  also  creep  into  data.  For  example, 
the  data  giver  may  adjust  his  figure  for  the  probability  of  suc¬ 
cess  of  his  project  upward  in  order  to  insure  its  inauguration  or 
continuance. 

Therefore,  unless  unavailability,  incompleteness,  and 
inaccuracy  of  data  are  avoided,  the  result  of  a  D.R.A.  will  be  as 
noted  in  the  title  to  this  subsection. 

JUDGEMENTS 


Even  when  data  can  be  made  available,  and  will  be  com¬ 
plete,  it  will  have  to  be  based  on  the  judgements  of  people.  Now, 
there  is  nothing  wrong  with  using  judgements.  The  strength  of 
the  D.R.A.  procedure  is  its  ability  to  take  judgements  -  subjective 
data,  probabilistic  data  -  and  use  them  in  an  objective  fashion, 
that  will  lead  to  a  decision  based  on  logic. 

The  problem  with  the  use  of  judgemental  data  is  whom  to 
get  it  from,  and  how  to  get  it.  The  question  of  whom  to  get  the 
judgements  from  involves  knowing  who  has  the  knowledge  and  back¬ 
ground  to  be  able  to  make  the  judgement.  In  many  cases  the 
judgement  making  ability  will  lie  with  a  subordinate,  and  it  will 
take  tact  and  diplomacy  to  get  around  the  subordinate's  super¬ 
visor. 
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The  question  of  how  to  get  these  judgements  involves 
getting  a  person  to  commit  himself  to  a  number  -  to  express  his 
judgement  as  an  objective  piece  of  data.  North  and  Spetzler 
discuss  an  interesting  approach  for  transforming  judgements  into 
probability  values.  Using  a  forced  choice  approach,  an  indivi¬ 
dual's  judgement  or  subjective  values  can  be  measured  on  a 
relative  scale.  This  can  then  be  transformed  into  a  utility 
plot,  based  on  the  concepts  taken  form  Utility  Theory. 

VALUE  ASSIGNMENT 

Associated  with  having  the  decision  maker  come  up  with 
his  honest  judgements  related  to  probabilities  of  success  or 
failure  of  an  event,  is  the  necessity  to  assign  dollar  values  to 
the  various  outcomes  indicated  by  a  decision  model.  The  approach 
in  this  case  may  have  to  be  initiated  by  the  highest  decision 
making  levels.  A  value  system  has  to  be  established  as  a  matter 
of  top  policy.  For  example,  what  is  the  cost  of  a  lost  life?  In 
a  California  case,  survivors  of  5  men  who  died  in  a  private  air¬ 
plane  crash  were  awarded  a  total  of  22  1/2  million  dollars.  Does 
this  make  the  value  of  a  life  about  4  1/2  million  dollars? 

Another  aspect  of  value  assignment  is  the  consideration 
of  intangibles.  For  example,  how  is  the  ecological  cost  calcula¬ 
ted  and  accounted  for?  The  outcome  may  be  an  oil  spill,  and  the 
costs  of  lost  product,  mop  up,  and  court  fine  can  be  calculated. 
However,  how  is  the  ecological  cost  calculated?  And  how  is  the 
cost  of  a  loss  of  customers  due  to  a  "bad  press"  calculated?  It 
will  be  a  guess,  at  best. 

WHAT  IF  THE  DATA  ARE  INCORRECT 

Between  unavailable  and  incomplete  data,  forced  judge¬ 
ments  and  value  assignments,  there  is  a  good  chance  that  the  data 
fed  into  the  decision  model  will  be  inaccurate.  At  this  point 
the  decision  maker  is  rescued  by  a  technique  called  Sensitivity 
Analysis  (5.A.).  The  S.A.  technique  allows  the  decision  maker  to 
vary  the  value  of  a  data  input  and  assess  its  influence  on  the 
decision  model's  outcome.  The  decision  maker  can  then  decide 
what  influence  an  error  in  the  value  of  data  inputs  will  have  on 
the  outcome.  He  will  be  surprised  at  the  number  of  data  inputs 
that  the  model  will  be  insensitive  to.  However,  if  the  model 
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outcome  is  very  sensitive  to  a  specific  input,  this  will  serve  to 
warn  the  decision  maxer  that  accuracy  of  data  input  is  essential. 

MODEL  BUILDING 


Another  problem  area  in  the  practice  of  D.R.A.  is  the 
building  of  the  model.  By  definition,  the  model  is  used  to  simu¬ 
late  the  real  world.  This  model  is  used  because  it  contains 
fewer  variables  -..'an  does  the  real  world,  and,  thereby,  is  easier 
to  man.  ~ilate  and  control.  However,  the  fewer  variables  in  the 
model,  the  more  inaccurate  will  be  its  simulation  of  the  real 
world.  But,  as  the  number  of  variables  increase,  and  the  simula¬ 
tion  approaches  "reality"  the  model  manipulation  becomes  exceeding¬ 
ly  difficult. 

Thus,  the  problem  of  model  building  is  one  of  how  many 
variables  to  use. 

Theoretically,  mathematical  and  statistical  techniques, 
with  the  aid  of  a  computer,  can  handle  many  variables  at  one 
time.  The  human  mind,  however,  cannot  handle  more  than  7  to  9 
variables  at  a  time.  Once  this  barrier  is  breached  the  meaning 
of  any  analysis  becomes  distorted  and  unintelligible. 

2  Invoking  rules  such  as  Pareto's  Law,1  Occam's  (Okham's) 

Law  and  Sensitivity  Analysis,  will  aid  in  the  determination  of 
the  number  of  variables  to  use  in  the  decision  model. 

An  example  of  the  proper  use  of  variables  in  decision 
models  is  the  use  of  the  mathematics  and  statistics  of  reliability 
engineering  to  determine  the  probability  of  success  of  a  system 
as  complicated  as  the  space  craft  and  missile  systems. 


Pareto's  Law  suggests  that  15%  of  the  total  number  of 
variables  will  account  for  60%  of  the  outcome,  25%  of  the  total 
number  of  variables  will  account  for  25%  of  the  outcome,  and  60% 
of  the  total  number  of  variables  will  account  for  only  15%  of 
the  outcome. 

2 

Occam's  (Okham's)  Law  (Razor,  Principle)  states  that 
in  explaining  things  not  knewn  to  exist,  the  number  of  entities 
(variables)  should  not  be  increased  unnecessarily.  Put  another 
way,  the  simplest  solution  is  the  preferred  solution. 
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It  was  initially  thought  that  each  individual  component  and  part 
would  have  to  be  put  into  the  reliability  model  in  order  to  get 
at  the  probability  of  success  of  the  system.  As  it  turned  out, 
not  all  component  failures  had  a  direct  influence  on  the  success 
of  the  mission,  while  other  components  and  parts  that  comprised 
mechanical  systems  could  be  assumed  to  have  a  100%  chance  of 
success.  By  these  and  other  means  the  number  of  critical  vari¬ 
ables  to  be  considered  were  drastically  cut  and  the  analysis 
became  manageable. 

OTHER  AIDS  TO  DATA  GATHERING  AND  MODEL  BUILDING 

One  way  of  improving  on  data  of  the  "uncertainties" 
variety  is  to  make  use  of  a  group  of  experts.  The  Rand  Corpo¬ 
ration  developed  a  group  decision  making  technique  called  the 
Delphi  Method.  The  concept  underlying  the  Delphi  approach  is  that 
many  heads  are  better  than  one.  In  the  Delphi  approach,  the 
experts  are  polled  on  their  opinions,  which  they  give  in  a  quan¬ 
tified  form.  These  opinions  are  then  laid  out  to  form  a  distribu¬ 
tion.  The  value  used  by  the  poll  taker  for  decision  purposes  is 
essentially  the  most  recurring  value  (mode)  in  the  distribution. 

Another  technique  to  aid  the  decision  maker  is  the  "In 
Favor  of  Analysis"  (I.F.A.).  The  I.F.A.  approach  is  especially 
helpful  in  treating  the  so-called  irreducibles  or  intangibles-- 
data  difficult  to  transform  into  dollar  amounts,  or  into  probabil¬ 
ities.  In  the  I.F.A.  each  variable  is  rated  on  a  relative  scale 
as  being  either  favorable  or  not  favorable  in  its  effect  on 
various  alternative  outcomes.  This  pattern  of  favorable  and  unfa¬ 
vorable  influences  can  aid  the  decision  maker  in  his  selection  of 
variables  or  outcomes. 

A  final  word  on  aids  to  the  decision  maker  concerns 
the  use  of  precognition  cr  intuition.  There  are  people  who 
have  an  uncanny  ability  to  fly  by  the  seat  of  their  pants.  They 
act  on  hunches  or  instinct,  or  what  may  more  properly  be  called 
intuition.  There  seems  to  be  something  unscientific  about  the  use 
of  hunches--at  least,  so  many  decision  makers  believe.  Yet,  the 
more  complex  the  decision  process,  the  more  incomplete  is  the 
support  evidence,  and,  therefore,  the  more  intuitive  the  decision 
must  become. 

If  there  are  people  in  an  organization  who  have  proven 
track  records  in  the  use  of  incuitivcly  developed  data,  in 
making  intuitive  decisions,  then  accept  their  judgments  on  variable 
values  and  even  their  choice  of  outcomes  to  strive  for.  Dc  not 
attempt  to  have  such  people  logically  explain  the  reasons  for 
their  choice.  Research  by  the  author  has  shown  a  relationship 
between  people  with  precognitive  abilities  and  decisions  producing 
good  outcomes  (profits). 
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CONCLUSION 


The  D.R.A.  approach  is  not  without  its  problems, 
especially  in  the  gathering  of  the  data,  and  the  building  of  the 
model  for  the  decision.  However,  model  building  problems  in  the 
D.R.A.  area  are  the  same  ones  as  found  with  model  building  in 
other  areas.  Therefore,  since  models  have  been  successful  in 
other  areas,  it  can  be  assumed  that  enough  knowledge  about  model 
building  can  be  acquired  to  have  it  be  successful  in  D.R.A.  also. 

As  to  the  data  collection  problem,  here  again  the  same 
admonition  can  be  given.  It  may  be  difficult  to  gather  the  data, 
but  the  D.R.A.  approach  does  present  a  logical  plan  to  consider 
variables  and  outcomes.  Experience  with  data  collecting  will 
improve  the  decision  maker's  ability  to  ferret  out  information, 
and  thus  improve  on  his  decision  making  process.  Initial  models 
can  be  made  of  small,  not-tco-complex  problems,  and,  as  the  model, 
building  and  data  gathering  abilities  improve,  the  applications 
can  be  to  more  complex  situations. 
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Ifyrotcchr. j  <:  Hazard  Evaluation  and  Pack  Concepts 


1.  Risk  Assessment; 

Edgewood  ’ s  program  of  pyrotechnic  hazard  evaluation  developed  the 
'Vorst  case  testing"  philosophy  as  a  result  of  the  failure  of  TB  700-2 
testing  to  properly  assess,  frem  a  safety  standpoint,  hazards  involved 
in  transportation,  manufacture,  and  storage  of  pyrotechnics . 

The  present  concept  in  conducting  a  risk  analysis  is  to  determine  for 
each  undesired  event  the  probability  (p)  of  its  occurrence  and  the  severity 
(S)  of  the  losses.  > 

Risk*-  =  f(p,s) 

Based  on  these  factors  the  event  is  deemed  safe/unsafe  depending  on  the 
degree  of  risk  resulting,  in  a  high/low  ranking. 

Failure  of  this  type  approach  is  demonstrated  in  the  transportation  in¬ 
dustry  in  that  it  is  based  on  past  accident  history  without  consideration 
of  the  ever  changing  nature  of  equivalent ,  cargo,  environment,  and  emo¬ 
tional  temperament  of  the  personnel.  Specifically,  the  degree  of  risk 
is  based  on  assumptions,  opinions,  and  intuitive  feelings  rather  than 
actual  data. 

N01  RtPR0°UC,BLt 


*  national  Transportation  Safety  Board 
Report  number:  WTS3-STS-71-1 


2.  Background : 


The  Edgewood  Arsenal  pyroteclinic  hazards  classification  and  evaluation 
program  is  designed  to  evaluate  materials  to  current  criteria  as  well 
as  determine  if  more  meaningful  criteria  could  be  developed. 

Based  on  the  rationale  that;  (l)  pyroteclinic  hazards  could  be  evaluated 
through  application  of  normal  and  abnormal  stimuli,  (2)  pyrotechnic 
hazard  evaluation  and  explosive  classification  standards  should  consider 
the  environmental  envelope. 

I 

This  activity  conducted  testing  on  a  selected  group  of  pyroteclinic  granu¬ 
lar  compositions  and  end  items  to  establish  the  hazard  classification 
appropriate  to  transportation,  handling,  and  storage  as  required  by 
U.  S.  Army  Technical  Bulletin  700-2. 

These  tests  consisted  of: 

—  Ignition  and  unconfined  burning  test 

---  Standard  detonation  test 

—  Thermal  stability  test 

—  Card  Gap  test 

—  Impact  Sensitivity  test 

The  ignition  and  unconfined  burning  test,  performed  to  determine  the  pro¬ 
bability  of  the  test  material  propagating  burning  or  deflagration  into  deto¬ 
nation,  is  evaluated  by  determining  whether  a  detonation  took  place  and 
by  recording  the  biiming  time  in  seconds.  Iloi/ever,  the  pyrotechnic  tested 
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simply  burned,  an  designed. 

The  standard  detonation  test,  performed  to  determine  the  probability  of 

the  test  material  detonating  in  free  air,  evidences  detonation  by  mush-  _ 

rooming  of  the  lead  cylinder,  but,  no  such  reaction  was  noted  for  any  sample. 

The  thermal  stability  test,  conducted  to  determine  the  probability  of 
the  test  material  decomposing  under  application  of  external  heat,  might 
lead  to  a  COT  forbidden  classification  should  explosion,  marked  decom¬ 
position,  or  turning  occur.  However,  the  results  were  negative  f.or  all . 

I 

samples . 

The  card  gap  test,  performed  to  determine  the  sensitivity  of  the  test 
material  to  sympathetic  detonation  from  an  explosive  shock  wave,  confirms 
detonation  of  the  sample  material  if  a  clean  hole  is  punched  in  the 
witness  plate.  None  of  the  pyrotechnic  card  gap  tests  resulted  in  evi¬ 
dence  of  detonation  —  in  fact,  they  indicated  that  the  pyrotechnic 
actually  attenuated  the  pentolite  reaction  rather  than  contributing  to  it. 

The  final  T3  7C0-2  test  performed  was  the  impact  sensitivity  test  utilized 
to  determine  the  probability  of  the  test  material  decomposing  or  detonating 
as  a  result  of  mechanical  shock.  Conducted  with  the  Standard  Bureau  of 
Explosives  apparatus,  using  an  8  pound  weight  impacting  on  a  10  milligram 
sample  at  drop  heights  of  up  to  10  inches,  the  test  is  evaluated  by  observing 
noise,  smoke  and/or  flame  and  decomposition.  While  the  validity  of  impact 
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The  objective  of  any  safety  analysis  is  to  establish  that  a  process  is 
safe  rather  than  unsaie;  and  this  is  the  primary  objective  of  worst  case 


testing. 


not  reproducible 


The  rationale  for  worst  case  testing  is  to  obtain  rough  order  of  magnitude 
of  potential  severity.  Therefore,  compensating  controls  for  "worst  case" 
will  apply  to  reactions  of  lesser  severity. 


From  a  program  point  of  view,  it  establishes  whether  there  is  a  requirement 
for  further  testing  to  determine  under  actual  conditions  the  existence  of 
a  hazard  potential  or  whether  further  testing  is  not  required  because  there 
is  only  a  minute  possibility  of  a  significant  hazard  potential.  Consequently 


worst  case  testing  is  designed  to  maximize  test  applicability  to  hazard 
analysis,  while  minimizing  the  number  of  required  tests. 

The  hazard  potential  is  related  to  the  probabilities  of  initiation, 
communi cation,  and  transition  (IC]‘) ;  thus,  the  actual  test  performed 
may  be  intended  to  measure  any  one  of  the  elements  of  the  ICT  sequence. 


Although  this  technique  has  been  applied  only  to  hazard  studies  in  which 
I'd'  provides  an  appropriate  framework,  it  also  has  general  applications 
outside  of  the  pyrotechnics  and  explosive  industry.  '  "  " 


The  consistency  matrix  shows  the  variety  of  interpretations  available 
from  a  worst  case  test  series. 


\ 


4.  Worst  Case  Simulations; 

Tn  older  to  recommend  modification  of  existing  standards,  Edgewood  conducted 
normal  and  'S-rorst  case"  operational  simulation  to  determine  the  hazards 
involved  in  the  manufacturing  and  transportation  environments . 


Based  on  the  rationale  that  pyrotechnic  dust  suspension  in  the  manufacturing 
environment  presents  initiation,  communication  and  transition  hazards,  tests 
utilizing  a  modified  Harthmann  apparatus  for  laboratory  evaluation  of  the 
explosive  characteristics  of  pyrotechnic  dusts  and  investigations  in  partly 
open  chambers  or  galleries  cf  75  cubic  inches  to  512  cubic  feet  were  conducted. 
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These  tests  resulted  in: 


—  Determination  and  correlation  of  ignition  (explosibility) 
characteristics  with  pyrotechnic  du3ts 

Development  of  order  of  magnitude  ancl  scale  requirements  for 
"run-tip"  potentials  in  processing  plants 


Attainment  of  a  "sonic  reaction  front"  in  tests 


Identification  of  follow-on  test  programs 


& 


,0^ 


& 


In  an  effort  to  establish  compensating  controls  for  potential  hazards  in 
the  manufo-ct’.^ing/processing  environment,  Edgewood  considered  worst  case 
conditions  to  determine  rough  order  of  magnitude  of  potential  severity. 


Essentially,  the  approach  for  this  "worst  case"  testing  was  to  determine  a 
pyrotechnic's  reaction  when  confined  to  the  maximum  credible  degree  under 
manufacturing  operations  (reaming,  mixing,  and  pressing)  and,  to  deter¬ 
mine  nature  and  degree  of  resultant  fragmentation/fire/overpressure  hazards. 


The  overall  "worst  case"  testing  project  developed  and  identified  needed 
"ICT"  parameters ;  established  that  detonation/fragmentation  hazards  did  not 
exist  in  any  operation  tested  and  identified  the  major  potential  hazards 
as  fire  and  low  grade  explosions. 

Hie  data  obtained  from  this  initial  probe  of  manufacturing/procecsing 
environment  has  already  resulted  in  more  meaningful  hazards  classification/ 
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protection  criteria,  increased  operational  flexibility,  and  new  technolo¬ 
gical  and  safety  concepts.  _ 

NOT  REPRODUCIBLE 

To  represent  a  maximum  probable  situation  in  the  transj^ortation  environment, 
Edgewood  utilized  l/50  scale  model  truck  trailers  constructed  for  con¬ 
finement  tests  on  nine  48  unit  cases  of  XM-9  C/S  canisters. 

The  results  of  the  two  tests  were  significantly  different.  In  the  48 
unit  trailer  test,  case  to  case  propagation  was  attenuated  and  fire 
suppression  was  accomplished  by  the  confined  environment  of  the  trailer. 

l 

simulator.  However,  in  the  500  unit  trailer  test,  the  single  case  was 
totally  cons' lined  and  rupture  of  simulator  at  12.5  P3I  allowed  total  burning 
of  all  C/S  and  trailer  simulator. 

These  tests  demonstrated  the  importance  of  packaging  material  and  design, 
as  well  as  revealing  the  need  for  new  concepts  such  as  the  requirement  for 
on-board  fire  suppressor/attenuator  systems.  In  essence,  this  philosophy 
affords  a  means  of  determining  the  hazards  and  risks  involved  in  the 
transportation,  storage,  and  handling  of  hazardous  materials  based  on  actual 
data  rather  than  assumptions,  formula,  opinions,  or  intuitive  feelings. 

In  summary,  the  Ed g -wood  Hazards  Evaluation  Program  has  accomplished  its 
job -evaluation  to  current  criteria.  Anomalies  have  been  identified  in 
existing  criteria,  and  recommendations  made  for  more  meaningful  standards. 


V.  PAUL  HENDERSON 
Edge-wood  Arsenal,  Maryland 
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The  environmental  risk  prising  from  the 
bulk  storage  of  dangerous  chemicals 

S.'I.  biccama  hirectoraat-Generaal  van  de  Arbeid 
Voorburg  -  Holland. 

"0r  oo„mi' 

.ur.nary 

In  this  paper  considerations  are  given  regarding  questions  as: 
"Is  there  a  danger  for  residental  area’s  from  the  bulk 
storage  of  dangerous  chemicals" 
and  "If  so  what  kind  of  danger  is  this  and  how  great  is  the 
danger  ?" 

In  the  first  section  a  theoretical  analysis  of  danger  and  the 
factors  involved  are  given. 

.’his  analysis  is  in  a  second  part  applied  to  the  bulk  storage 
of  dangerous  chemicals. 

method  for  an  approach  to  tackle  the  problem  of  storage  of 
dangerous  liquids  and  distance  from  residential  area’s  is 
iven. 

In  the  conclusions  a  recommendation  for  international  exchange 
of  information  is  included. 
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The  environmental  rink  arisin,  ■  from  the 


bulk  storage  of  dangerous  chemicals. 

i 


Introduction 

For  several  years  the  chemical  industry  has  been 
growing  at  a  fast  rate  and  this  consequently  bears  its 
influence  on  the  streams  of  raw-materials  intermediates  and 
end-products.  These  materials  are  being  stored  and  shipped 
in  increasing  units  and  quantities. 

A  considerable  number  of  the  chemical  substances  used, 
produced  and/or  stored  in  the  chemical  industry  are  classified 
as  dangerous  substances.  This  means,  that  through  their 
properties  they  have  the  capability  of  inflicting  harm  upon 
their  environment. 

This  situation  being  so  one  has  to  try  to  solve  questions  as: 

1.  Is  there  a  danger  for  the  general  population  from  the 
storage  of  dangerous  materials': 

2.  If  so,  what  kind  of  danger  is  this  and 

3.  now  great  is  this  danger? 

In  this  paper  consideration  will  only  be  given  to  the  dangers 
resulting  from  a  large  incident  at  the  storage  of  danrerous 
materials  or  during  shipping  of  dangerous  materials.  (The 
influence  of  continuous  pollution  of  the  air  from  venting  or 
nirnila#*-  operations  therefore,  will  not  be  taken  into 
consideration. ) 
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'rtecretical  Analysis  - 


In  order  to  be  able  to  answer  the  above-mentioned 


questions  one  has  to  determine  which  factors  are  involved. 

Any  danger  now,  is  a  combination  of  two  essential  items 
'i .  the  hazard;  that  is  the  potential  capability  to  inflict 
harm. 

2.  the  risk;  that  is  the  probability,  that  harm  is  being 
realised. 

-he  magnitude  of  the  hazard  together  with  the  magnitude  of 
the  risk  gives  the  magnitude  of  the  danger, 

combination  of  two  systems  (a)  and  (b)  will  r.ow  be 
considered,  whereby  system  (a)  presents  a  danger  for  system 

vb) . 

1*  -‘he  hazard  in  this  situation  depends  on: 

1.1  The  properties  of  the  constituents  of  system  (a) 

1 . a  The  size  of  system  (a) 

1.3  The  distance  between  system  (a)  and  system  (b) 

1.A  The  possible  presence  of  some  ind  of  protection. 

T.  The  risk  in  this  system  depends  on: 

2. 1  The  type  of  system  (a) 

~'.T  .internal  factors  of  the  sysuem  (a) 

-’•3  external  factors  influencing  system  (a) 

T.4  Independant  factor-  with  regard  to  system  (a)  and 
system  (b). 


,one 


c  -mments  on  the 


factors  |  which  determine  *•  he  hazard . 


he  ;ro:c-rties  of  the  cons  tit  uen  t 


1 . 1 . 1 . Transfer  of  kinetic  energy;  this  is  the  case  if 
system  (a)  or  parts  oeionging  to  system  (a)  collide 
with  system  (b) 

1 . 1 . 2.  -sudden  release  of  potential  energy;  trip  is  the 
case  when  a  fire  or  an  explosion  is  generated; 

1.1. 3. Other  ways  of  generating  an  impact;  eruption  of 
toxic  gas,  harmful  radiation,  germs. 

1 . 2  The  size-  of  system  (a) 

It  will  be  apparent,  that  the  size  of  system  (a)  is  one 
of  the  most  important  factors,  which  determine  the 
possibility  to  influence  system  (b). 

Not  only  the  size,  but  -iso  the  length  of  the  period, 
during  which  system  (a)  exhibits  its  harmful  effect,  is 
very  important;  e.g.  the  amount  to  which  and  the  time 
during  which  people  are  exposed  will  determine  the 
severity  of  the  effects  of  toxic  gases;  the  same  amount 
of  energy  released  over  a  ve-y  short  Period  of  time 
(detonation)  is  much  more  har  ful  than  that  same  amount 
released  over  a  longer  period  v  ieflagration) . 

In  order  to  estimate  the  hazard  of  a  system,  one  has  to 
determine  the  "maximum  credible  accident". 

-he  maximum  credible  accident  is  the  largest  accident, 
which  one  can  imagine  to  occur  under  any  conceivable 
c i r c urns t.  nee. 

/  _ 

1  •  ^ 


112 


3  Phe  distance  between  system  (a)  system  (b) 

It  is  evident,  that  the  {greater  the  distance  between 
system  (a)  and  system  (b)  the  less  the  influence. 

The  factor  of  distance  is  a  very  important  parameter  as 
for  instance  in  the  case  of  the  spreading  of  toxic  gases, 
roughly  sneaking  the  concentration  is  inversely  pro¬ 
portional  to  the  square  of  the  distance. 

do  if  the  distance  is  doubled,  the  concentration  will  be 
reduced  approximately  by  a  factor  of  four. 

.Vt  that  distance,  where  the  greatest  change  in  system  (a) 
has  no  longer  ill  effects  on  system  (b),  system  (b)  is  in 
absolute  safety.  The  danger  is  then  nil. 

Phis  :Lstance  in  practical  cases  often  can't  be  realised 
and  therefore  a  so-called  "safe  distance"  should  be 
determined.  The  "safe  distance"  in  this  regard  is  that 
distance  at  which  system  (a)  presents  an  acceptable 
calculated  danger  for  system  (b).  (The  determination  of 
the  safe  distance  is  fundamentally  a  policy  decision!) 

.4  The  ossible  presenc--  o:  some  kind  of  protection 

Regarding  protection  or  protective  systems  one  can  think 
of  various  possibilities  (which  need  not  be  equivalent 
arr  .ngenents). 

Three  different  types  can  be  distinguished : 
a  natural  system  (e.  .  hills,  rivers) 
n  technical  installation  ( t  •■nkwal  1 ,  automatic 
sh  ut  .low n  v p u i  tie n t ) 

an  organisational  system  (star. I- by  rescue/ fire 
i  pile) 
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Remark :  It  would  be  desirable  to  develop  a  way  to  compare 
these  types  of  systems  with  the  protection  gained 
by  distance.  In  that  case,  one  could  correlate  the 
protection  gained  by  a  system  with  the  protection 
gained  by  distance  only. 

dome  comments  regarding  the  factors  which  determine  the  risk. 

2.1  The  type  of  system  (a) 

The  probability  of  system  (b)  being  harmfully  influenced 
is  directly  dependant  upon  the  probability  of  the 
occurence  of  a  large  incident. 

This  again  depends  on  the  character  of  system  (a). 

There  is  a  great  difference  between  storage,  transport 
and  processing.  In  any  of  these  systems  the  way  of 
handling  and  the  frequency  of  handling  is  different  from 
the  others. 

In  general  it  is  the  amount  of  handling,  that  determines 
the  risk. 

2.2  Internal  factors  of  system  (a) 

dome  factors  which  undoubtedly  have  a  great  influence  on 
the  chance  of  an  accident  occurring  are  : 
the  choice  of  materials  of  construction 
the  state  of  maintenance 
the  policy  of  top-managemer.t 
the  lay-out  of  the  plant 
the  level  and  number  of  employees  etc. 

2. 3  External  factors  influencing  system  (a) 

dome  examples  are: 
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-  regulations 


regulations  from  authorities 

amount  and  thoroughness 
of  inspection  from  authorities 

actions  of  third  parties; 

T.4  Independent  factors  with  regard  to  system  (a)  and 

s.ystem  (u) 

The  most  important  independant  factor  is  the  type  of 
weather . 

This  can  be  extremely  important  in  connection  with  the 
development  of  explosive  gas-mixtures  and  the  diffusion 
of  toxic  gases. 

application  of  the  theoretical  analysis  for 
the  bulkstorage  of  dangerous  materials 

The  dangers  related  to  the  presence  of  harmful  materials 
arise  from  the  storage  and  the  transport  of  these  products. 
Transport  occurs  by  shij^  road-t anker ,  rail  or  pipeline. 

The  factors,  which  determine  the  danger  were  given  in 
1.1  to  1.4  inclusive  and  2.1  to  2.4  inclusive. 

The  shipment  of  a  dangerous  product  (either  by  water  or  by 
land)  can  be  considered  to  be  a  mobile  storage  system.  This 
implies  that  the  hazard  will  be  the  same  as  in  the  case  of  a 
fixed  storage  system,  but  the  risk  is  different. 
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The  - 


The  hazard 


The  hazard  is  given  by  the  factors  1.1  to  1.4  inclusive 

Factor  1.1:  The  properties  of  the  constituents. 

This  in  fact  means  the  properties  of  the 
materials,  which  are  stored. 

In  a  storage-system  transfer  of  kirecic  energy 
can  be  excluded;  possible  ways  of  affecting  the 
environment  are  however: 

fire,  explosion,  eruption  of  toxic  gases  and 
ceni  '.■■nination  of  the  soil  or  watersystems  with 
toxic  products. 

Factor  1.2:  The  size. 

In  the  evaluations  the  influence  of  the  maximum 
credible  accidents  have  to  be  considered.  Jo  these 
maximum  credible  accidents  must  be  selected. 

The  bulkstorage  of  dangerous  materials  can  be: 
storage  of  solids 
storage  of  liquids 

storage  of  gases  vor  liquefied  gases) 

The  accidents,  which  have  the  widest  direct 
influence  are  those  accidents,  which  occur  with 
large  quantities  and  which  result  in  the 
generation  of  toxic  vapours. 

For  Holland  the  maximum  credible  accidents  are 
probably : 
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Land-storage 

Transport 

Solids 

Decomposition  of 
ammonium-nitrate 
fertilizer 

3 ear  tons 

Sea-transport 
decomposition 
of  <3t>0C>  tons . 

Liquids 

Release  of  5000  m3 
Acrylonitrile  in  a 
tank-pit  of  1o00  m2 

Outflow  of  1000  m3 
acrylonitrile 
in  the  river 

Gases 

Release  of  LFG 
followed  by  detonation 
and  fire 

Release  of  50  tons 
of  liquid  chlorine 
(rail-tankcar) 
or  release  of</<wwtons 
of  liquid  ammonia 
into  the  river. 

For  liquids  the  complete  release  of  the  contents 
of  a  storage-tank  is  taken.  3ecause  of  the 
regulations  in  the  Rotterdam  port-area  this 
results  in  5000  m3  in  a  tankpit  of  1600  m2. 

Cn  the  same  grounds  the  ecomposition  ofJae*tons 
fertilizer  is  chosen. 

In  the  case  of  gases  the  complete  release  of  a 
chlorine-  or  ammonia-tank  seems  inconceivable. 
Therefore  the  release  of  LPG  is  chosen. 

In  the  case  of  the  transport-accidents,  the 
quantities  chosen  are  the  largest  quantities, 
transported  regularly  in  one  unit. 

Factor  1.3:  The  distance 

A  large  fire  even  if  some  tanks  are  involved,  has 

a  direct  influence  on  the  environment  which 

remains  restricted  to  an  area  within  500  m  of 

the  fire. 
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A  large  explosion  (detonation)  exhibits  its 
influence  at  a  much  wider  area.  From  experience 
however  it  can  be  said  that  generally  serious 
damage  does  not  occur  at  a  distance  larger  than 
+  1500  m. 

In  agreement  with  this  experience  are  some  inter¬ 
national  regulations  which  prescribe  a  distance  of 
1000  -  1600  m  between  residential  area's  ar.  d  the 
storage  of  units  of  100  tons  of  ammunition  of  the 
most  dangerous  type. 


Release  of  toxic  gases  cr  vapours  can  result  in 
dangerous  situations  at  comparatively  large 
distances . 

One  has  to  think  in  terms  of  km's. 

hat  actually  will  be  the  situation  depends  mainly 
on  the  quantity  released  ,  the  time-period  during 
which  the  emission  takes  place  and  the  atmospheric 


stability. 


not  reproducible 


Factor  l.4:The  possible  presence  of  some  kind  of  protection. 


Through  installation  of  technical  provisions  one 
may  be  able  to  restrict  the  influence  of  a  possible 
incident,  storage  of  explosive  chemicals  can  be 
surrounded  by  concrete  walls  and  spillages  of 
li  uids  producing  toxic  vapours  may  te  covered 
with  foam,  bsorption-towers  may  provide  protection 
against  spillage  of  toxic  gases. 

All  these  types  cf  protection  will  shorten  the 

"safe  distance". 
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The  more  reliable  the  protection  the  smaller  the 
:'safe  distance"  can  be,  as  the  "safe  distance"  is 
defined  as  that  distance,  at  vhich  >ne  stands  an 
evaluated  and  accepted  amount  of  danger. 

As  much  as  possible  quantification  of  the  danger 
should  be  carried  out. 

for  instance,  if  it  can  be  assured  that  a 
spillage  of  acrylonitrile  will  be  covered  with 
foam,  within  half  an  hour  the  "safe  distance"  can 
be  based  on  the  EEL-value  for  the  general 
population  for  {■  hour,  (see  Emergency  Exposure 
Limit) 

Not  reproducible 

Vhat  hazard  is  to  be  expected  at  different  distances? 

As  in  Holland  in  the  Rotterdam  port-area  large  quantities  of 
acrylonitrile  are  handled,  this  question  has  been  examined 
for  the  maximum  credible  accident  at  land-storage,  which 
means  a  tank-pit  cf  loOO  m ?.  covered  with  acrylonitrile. 

The  effects  will  depend  mainly  on  the  weather  conditions. 
p’or  sake  of  simplicity  a  division  into  three  groupings  will 
be  taken: 

Unstable-,  neutral-  and  stable  atmospheric  conditions. 

(In  terms  of  i'asquill  classification:  A-B,  C-D  and  E-F) 

As  the  vapour  pressure  depends  on  the  temperature  a  rough 
separation  between  summer-  and  winterconditiona  ia  necessary. 

-  or  our  country  this  t^eans,  that  the  vapour  pressure  in  winter¬ 
time  is  approximately  0,45  times  the  vapour  pressure  in  summer¬ 
time  . 
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For  the  "maximum  credible  accident"  of  loOO  m2  of  acrylo¬ 
nitrile  in  a  tankpit  the  following  sources  of  emission  were1 
calculated  for  summer-conditions: 

Unstable  atmospheric  condition:  5*9  kg/rti2h 
Neutral  atmospheric  condition  :  10.2  kg/m2h 
Stable  atmospheric  condition  :  7,2  kg/m2h. 

In  case  of  winter-time  the  sources  of  emission  are  calculated 
from  these  figures  by  multiplying  with  the  factor  0.45. 

For  the  valuus  of  concentrations  to  be  expected  at  various 
distances  is  calculated:  (ref.  1.) 


Acrylonitrile  concentration  in  mg/mj. 


Atmosph. 

^N''*qondition 

.distance 

Unstable 

summer  winter 

Neutral 

summer  winter 

Stable 

summer  winter 

100 

m 

2500 

1100 

4p00 

2200 

30.000 

13.000 

300 

m 

250 

100 

900 

400 

5.000 

2.250 

500 

m 

100 

45 

300 

135 

2.000 

900 

1000 

m 

50 

20 

100 

45 

65O 

300 

2500 

m 

15 

7 

20 

8 

175 

80 

5000 

m 

2 

1 

1 

<1 

65 

30 

In  case  of  water-transport  the  assumed  maximum  credible 
accident  was  the  outflow  of  approx.  1000  tons  of  acrylonitrile 
into  the  harbour. 

At  such  an  incident  the  liquid  will  spread  itself  very  rapidly 
over  the  water-surface. 

The  width  of  the  river  in  the  Kotterdam  port  is  ±  500  m.  So 
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not  reproducible 


if  one  assumes  a  final  layer  thickness  of  1  mm,  the  liquid 
will  spread  over  a  length  of  2  km.  In  practice  this  will  not 
be  so,  as  evaporation  and  dissolution  will  take  place. 

The  spreading  of  this  sort  of  liquid  however  is  much  quicker 
than  the  evaporation  and  dissolution. 

From  comparison  v/ith  gasoline  one  would  expect  a  spreading 
over  a  width  of  500  m  and  a  length  of  1000  m  in  10-20 
minutes,  (kef.  2) 

If  no  evaporation  and  dissolution  would  have  happened,  the 
layer-thickness  would  have  been  2  mm.  In  the  majority  of 
weather-condit: cns  the  combined  evaporation  and  dissolution 
?..n  a  period  up  to  20  minutes  would  not  account  for  a  reduction 
of  layer-thicknecs  of  1  rim  (being  +  5^0  tons). 

Therefore  one  has  to  expect  a  spreading  over  the  full  width 
of  the  river  ever  a  length  of  at  least  1  km.,  with  a  film 
1  mm  thick. 

The  evaporation  is  estimated  at  2,2  kg/m?h.  This  would  mean, 

+  20  tons/nin.  om  the  estimated  surface. 

The  evaporation  rate  will  be  relatively  lowered  in  case  of 
such  a  large  surface.  Also  the  influence  of  the  wind  speed 
and  the  temperature  is  very  large.  Another  factor  is  the 
dissolution  in  water,  /ill  these  factors  together  determine 
the  time-period,  during  which  the  dangerous  situation  will 
exist . 

From  these  considerations  , however  one  can  say  that  this 
situation  will  be  present  over, a  time-period  ranging  from 
half  an  hour  to  two  hours. 

A  complicating  factor  is  the  tide.  This  can  mean  that  the 
evaporating  surface  moves  up  or  down  the  river. 

To  predict  downwind  vapour-concentrations  at  various  distances 
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is  very  difficult  indeed.  The  large  surface  implies  a  strong 
source  of  emission.  The  larger  the  surface  the  smaller  the 
time-period  during  which  this  situation  will  exist. 

It  seems  probable  however  that  one  has  to  reckon  with 
dangerous  concentrations  at  distances  up  to  several  km's. 

.,afe  distance:  What  will  be  in  case  of  these  "maximum  credible 
accidents"  the  "safe  distance"? 

As  already  mentioned,  this  is  in  fact  a  policy-decision,  as 
one  has  to  answer  the  question: 

"..'hat  danger  is  acceptable  at  what  frequency?" 

It  seems  logical  to  use  for  the  permissible  dose  the  concept 
Emergency  Exposure  Limit.  This  value  is  that  concentration, 
that  the  general  population  in  emergency  conditions  is 
supposed  to  be  able  to  withstand  for  a  certain  time-period 
without  an  irreversible  negative  effect.  IhL-values  are  given 
usually  for  half  an  hour  or  1  hour. 

In  our  country  an  EEL  of  90  mg/m3  is  accepted  for  exposure 
during  a  half  hour  to  acrylonitrile. 

The  question  remains;  now  often  can  we  accept  such  a 
situation? 

This  question  has  to  oe  answered  by  the  authorities. 

Ihe  disk 

Cnly  regarding  land-storage  tanks  some  information  appeared 
to  be  available  in  Holland  on  the  occurence  of  large  incidents. 
Therefore  quantification  of  the  risk  is  only  attempted  for 
this  type  of  accident. 

The  factors,  which  determine  the  risk  hove  been  given  in 
T.1  to  ?.b  inclusive. 

-  Except  - 
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Except  for  factor  2.4  it  is  almost  impossible  to  calculate 
the  influence  of  the  individual  factors.  Therefore  some  idea 
of  the  order  of  frequency  of  the  incidence  (possibility)  of 
these  large  accidents  must  be  collected  from  the  history  of 
incidents. 

From  a  survey  on  large  incidents  with  storage  tanks  in  the 
Rotterdam  industrial  area  it  appeared  that  from  1945  to  1970 
there  has  been  one  serious  incident  per  +  5000  tank-years. 

(a  total  of  11  incidents)  A  tank-year  is  a  tank,  that  has  been 
in  v  for  i  year. 

‘his  survey  included  all  sorts  of  tanks. 

decause  of  the  factors  2.2  and  2.3  the  storage  of  dangerous 
liquids  is  regarded  with  more  care  than  that  of  other  liquids. 
It  is  therefore  safe  to  say  that  the  chance  of  a  large 
incident  occuring  at  the  storage  of  dangerous  liquids  in  the 
Aotterdam-area  is  smaller  than  once  per  3000  tank-years. 

NOT  RtPWt>UCIBU 

The  influence  of  the  weather-conditions. 

The  risk  for  population  situated  a  certain  distance  from  a 
storage  of  dangerous  liquids  also  depends  on  the  atmospheric 
stability  at  the  time  of  the  incident  occuring.  The  influence 
has  been  shown  in  the  table  on  page  11, 

.Now  the  question  remains:  "how  often  are  unstable-,  neutral- 
or  stable  atmospheric  conditions  occuring?" 

From  a  survey  of  the  dutch  loyal  Ins: tute  of  Meteorology  it 
appears,  that  for  the  Rotterdam  Area  the  situation  is: 

Unstable  atmospheric  conditions:  12,5  <> 

Neutral  atmospheric  conditions  :  65  •') 

-table  atmospheric  conditions  :  2?t5.S 
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Determination  ol  the  danger  and  the  "safe  distance11  for  a 


residential  area. 

Through  combination  of  the  figures  from  the  table  on  page  11 
and  the  percentages  mentioned  above,  one  is  able  to  estimate 
the  probability  for  various  concentrations  at  various 
distances . 

» 

fi.is  leads  to  the  curves  given  in  figure  1. 

As  EEL-value  for  half  an  hour  90  mg/m?  ,-,as  quoted. 

From  figure  1  it  is  seen  that  at  a  distance  of  ?500  m  there 
is  a  probability  of  20/a  of  exceeding  this  value  (at  a  distance 
of  1000  m  this  probability  exceeds  50/.) 

The  chances  of  the  maximum  credible  accident  occuring  at  the 
storage  were  once  in  3000  tank-years  or  less. 

If  it  is  assumed  that  residential  area's  are  situated  in 
half  of  the  v.'ind-directions  around  the  storage,  the  chances 
are  once  in  6000  tank-years. 

07  roughly  spoken  3torage-tanks  are  just  as  often  full  as 
empty,  so  tae  chances  for  an  accident  with  a  full  tank  are 
once  in  12.000  tank-years 

nt  a  distance  of  2500  rr.  the  probability  of  exceeding  the 
Sih-value  at  a  residential  area  are  20%. 

6o  this  means  once  in  60.000  tank-years. 

If  now  the  accented  risk  is  fixed  at  once  in  10.000  years,  this 
means  that  a  storage  of  6  large  tanks  is  acceptable  in  a 
situation  where  residential  area's  are  at  a  distance  of  2500 
m  from  the  bulk  storage. 

-Vor.  the  above  given  reasoning  it  will  be  clear,  that  this  is 
only  an  attempt  to  approach  the  order  of  magnitude. 
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As  dangerous  liquids  »ro  treated  with  much  care  and  stringent 
conditions  are  maintained  for  the  technical  provisions,  the 
above  mentioned  number  of  6  tanks  can  os  well  be  1 2  or  l8. 
is  sufficient  statistical  information  on  incidents  with  bulk 
storage  of  dangerous  liquids  is  lacking,  the  inaccuracy  is 
evident. 

The  same  applies  for  the  risk  from  other  ''maximum  credible 
accidents".  'Ve  are  still  trying  to  collect  information  for 
our  country  on  the  frequency  of  accidents.  The  same  approach 
however  is  in  principle  possible  for  any  accident.  For  water- 
transport  one  has  probably  to  work  with  "ship-movements"  in* 
stead  of  tank-years. 

A  "ship-movement"  is  a  ship  moving  from  one  location  in  the 
port-area  to  another  location. 

Conclusions  and  decomnendations. 

2*  approach  is  given  for  the  estimation  of  risk  for 

residential  area's  because  of  bulk  storage  of  dangerous 
lir-uids . 

2*  As  sufficient  information  for  statistical  calculations  are 
lacking,  only  the  order  of  magnitude  can  be  indicated. 

2*  To  improve  the  accuracy  of  this  method  it  will  be  necessary 
to  collect  the  information  on  large  incidents  on  a  world 
wide  basis. 

The  problem  of  hazard  evaluation  in  connection  with  dangerous 

chemicals  is  an  international  problem. 

ngerouu  c hemic. -.Is  are  shipped  from  one  country  to  another. 

-'here fore  agreement  on  criteria  for  those  hazards  is  needed. 

fne  collection  of  information  on  the  hazards  of  dangerous 
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chemicals 


chemicals  is  a  rather  slow  operation.  Much  has  to  be  gained 
from  experience. 

It  is  like  the  fitting  of  a  jig-saw  puzzle. 

.is  other  countries  may  have  in  their  possesion  several  pieces 
of  the  puzzle,  international  exchange  of  information  is 
highly  jceirable. 

This  leads  to  the  following  NOT  REPRODUCIBLE 

Recommendations  for  .joint  efforts: 

1.  that  a  hazard  classification  system  be  developed  with 
mutual  agreement  on  criteria;  as  a  basis  the  tentative 
guide  of  the  Rational  Academy  of  .lienee  can  be  taken; 
further  implementations  of  the  physical  properties  seen.' 
desirable ; 

?.,  that  each  party  assembles  an  inventory  of  known  experimen¬ 
tal  v’orx  t  larger  scales  .r.  '  sends  this  information  to 
the  other  party; 

5.  that  proposed  experimental  programmes  be  sent  for  comments 
to  the  other  oarty; 

that  communication  be  established  between  working  groups 
dealing  with  the  determination  of  -l--valuts  for  relevant 
chemicals;  proposed  hv,L- values  together  with  the  infor¬ 
mation  on  which  the  figures  are  based  should  he  exchanged 
for  comments; 

5.  that  for  coordination  a  liaisor-group  bs  formed  which  will 
meet  once  in  two  years  and  v/nicn  provide  on  either  side  an 
address  for  contact. 
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THE  GEOGRAPHY  AND  ECOLOGY  OF  THE 


HOUSTON  SHIP  CHANNEL  -  GALVESTON  BAY  SYSTEM 


Galveston  Bay  (Figure  1)  on  the  Texas  Gulf  Coast  is  a  large,  highly 
productive  and  economically  important  environmental  system.  The  Bay 
encompasses  over  500  square  miles  in  surface  area  and  is  very  shallow  with 
an  average  depth  of  approximately  6  feet  and  a  maximum  depth  of  10  feet 
except  in  dredged  channels. 

Various  estimates  claim  that  from  60  to  90%  of  the  aquatic  life  on 
the  Texas  Gulf  Coast  spends  some  time  of  its  life  cycle  either  in  or 
dependent  upon  Galveston  Bay.  A  substantial  commercial  fishing  industry 
harvests  shellfish  including  crab,  shrimp  and  oysters,  and  a  variety  of 
fin  fish.  The  Bay  provides  substantial  recreation  benefits  including 
boating,  swimming  and  fishing. 

The  Bay  is  of  great  importance  for  the  shipping  which  connects  Hous¬ 
ton,  Texas  City,  Galveston  and  other  minor  ports  with  the  trade  centers 
of  the  world.  Houston  presently  is  the  nation^  third  largest  port. 

The  Houston  Ship  Channel  is  a  dredged  channel  which  traverses  a  dis¬ 
tance  of  55  miles  from  outside  Galveston  Island  through  Galveston  Bay  and 
inland  to  the  port  of  Houston.  In  its  upper  25  miles  the  deep  draft 
waterway  is  an  environmental  modification  of  Buffalo  Bayou  and  the  San 
Jacinto  River.  The  banks  of  the  channel  are  broken  by  12  bayous,  the  San 
Jacinto  River,  several  tidal  flats  and  small  shallow  bays.  The  upper 
channel  with  reference  mils  points  is  shown  in  Figure  2.  First  modifica¬ 
tions  of  the  system  originated  in  March  1905,  when  channel  bends  were 
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widened  and  pile  dikes  constructed  along  the  channel.  Dredging  work  on 
the  channel  began  in  190*  when  the  city  of  Houston  started  developing  a 
16  foot  deep  channel.  The  turning  basin  and  the  slips  at  Houston  were 
excavated  between  December  1906  and  May  1910. 

Two  years  later,  in  1912,  a  contract  was  made  to  provide  a  25  foot 
channel  from  the  Gulf,  across  25  miles  of  fast  shoaling  Galveston  Bay 
and  30  miles  through  Buffalo  Bayou,  to  the  turning  basin.  This  contract 
required  th. the  entire  55  miles  of  channel,  in  full  specified  width 
and  depth,  be  turned  over  at  one  time  to  the  United  States  Army  Corps  of 
Engineers,  in  the  years  from  1919  to  1925,  the  waterway  was  deepened  to 
30  feet,  widened,  and  the  Houston  Turning  Basin  enlarged.  Bends  were 
realigned  and  the  Inland  portion  of  the  channel  from  Morgan's  Point 
to  Baytown  was  widened  during  the  period  from  1930  to  1935.  The  main  channel 
was  widened  and  the  depth  was  lowered  to  34  feet  in  the  1935-1945  period. 
After  1945,  further  widening  of  the  channel  was  carried  out  until  1948. 

In  1948,  a  ten  year  deepening  and  widening  project  was  initiated,  which 
called  for  a  channel  36  feet  deep.  In  1958  and  1959,  the  channel  depth 
was  increased  to  40  feet  in  all  sections  except  that  portion  of  the  water¬ 
way  from  Sims  Bayou  to  the  Turning  Basin.  Since  1960,  Corps  of  Engineers 
sponsored  improvements  have  included  realignment  of  bends,  and  depth 
increases  to  42  feet  in  the  lower  reaches  of  the  waterway.  Today,  the 
bottom  width  of  the  channel  ranges  from  150  feet  in  the  Houston  Turning 
Basin  to  1000  feet  at  some  locations  along  the  channel. 

Since  the  end  of  World  War  II,  the  Houston  Ship  Channel  industrial 
complex  has  undergone  tremendous  expansion,  and  as  a  result,  the  channel 
now  receives  heavy  pollution  loadings  comprised  of  both  domestic  and 


industrial  wastes.  These  heavy  waste  loads  together  with  the  sluggish 
flow  characteristics  of  the  waterway  have  over-loaded  the  natural  purifica¬ 
tion  capability  of  the  estuary  resulting  in  a  severe  pollution  problem. 

Many  of  the  major  ship  channel  industries  and  their  products  are 
shown  in  Figure  3. 

The  Houston  Ship  Channel  has  served  as  the  receiving  water  for  the 
waste  materials  from  the  Houston  metropolitan  area  and  its  tremendous 
industrial  complex.  The  location  of  the  major  industrial  and  domestic 
waste  sources  are  shown  in  Figures  2  and  3. 

The  effect  of  these  wastes  in  the  degradation  of  the  water  quality 
has  been  magnified  by  the  predominant  physical  features  of  flow,  tide 
and  salinity. 

Flow  statistics  for  the  upper  Houston  Ship  Channel  are  shown  in 
Figure  4.  In  10%  of  the  months  the  flow  is  100  cubic  feet  per  second  or 
less.  In  only  half  of  the  months  does  the  flow  exceed  430  cfs.  Thus 
waste  materials  remain  in  the  channel  for  an  average  of  43  days. 

The  tidal  range  on  the  Gulf  Coast  is  only  on  the  order  of  one  foot. 
This  low  tidal  exchange  minimized  diffusion,  flushing  and  natural  reaera¬ 
tion,  The  system  is  saline  with  salinities  ranging  from  almost  none  to 
as  high  as  25  ppt  in  the  upper  reaches  as  a  function  of  flow  and  turbu¬ 
lence.  Both  homogeneous  and  highly  stratified  vertical  salinity  gradients 
are  observed. 

Almost  every  classical  form  of  polTution  may  be  observed  In  the 
channel.  Readily  observable  pollution  Is  often  observable  as  demonstrated 
in  Figure  5. 
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Bacteriological  contamination  occurs  from  poorly  treated  domestic  sources. 
Figure  6  showscoliform  levels  in  the  upper  ship  channel.  If  two  gallons 
of  this  water  were  mixed  into  a  20,000  gallon  home  or  apartment  swimming 
pool,  the  bacterial  quality  would  be  degraded  below  acceptable  swimming 
water  standards. 

Much  of  Galveston  Bay  is  closed  to  oyster  harvesting  because  of  poor 
bacterial  quality. 

Ovygen  demanding  organics  are  discharged  into  the  channel  In  such 
magnitude  as  to  overpower  the  oxygen  replacement  capability  of  the  channel. 
As  of  1968,  the  loading  approached  500,000  pounds  per  day,  expressed  as 
ultimate  BOD  (biochemical  oxygen  demand);  or  in  lay  terms,  this  would 
equal  the  raw  sewage  load  of  3  million  people  or  be  approximately  equal 
to  500,000  pounds  of  sugar  per  day. 

Recent  improvements  have  reduced  this  combined  domestic  waste, 
industrial  waste  and  urban  runoff  load  tc  about  250,000  pounds  per  day  of 
ultimate  BOD.  The  effect  of  this  loading  is  shown  in  Figure  7.  In  each 
month  of  the  year,  no  dissolved  oxygen  Is  found  in  the  upper  16  miles  of 
the  channel.  Only  in  the  bottom  few  miles  do  oxygen  levels  exist  that  can 
occasionally  support  aquatic  life. 

Analytical  models  developed  by  Texas  A&M  University  estimate  waste 
load  reductions  to  a  level  of  25,000  -  50,000  lbs/day  (BODg)  are  required 
during  the  different  months  of  the  year  to  maintain  minimum  dissolved 
oxygen  levels. 

Since  present  economical  waste  treatment  technology  cannot  meet 
these  levels,  new  concepts  Including  In-channel  aeration  are  being 
investigated. 
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Nutrients  have  not  been  thoroughly  studied,  but  problems  are  expected 
from  the  present  and  future  high  levels  ar.d  substantial  algae  blooms  are 
periodically  observed  in  upper  Galveston  Bay. 

Periodic  oil  slicks  are  noted  in  the  channel  as  a  result  of  spillage 
from  vessel  loading  operations  and  from  industrial  discharges. 

Sediment  materials  build  up  in  the  channel  at  the  rate  of  from  two  to 
four  feet  per  year.  These  sediments  are  a  combination  of  silt  which  washes 
from  the  urban  areas  and  organic  sludge  components. 

Research  at  Texas  A&M  University  has  shown  that  32%  of  the  organic 
waste  discharge  becomes  entrapped  in  the  bottom  sediments.  Some  20,000 
acre  feet  per  year  of  this  black  greasy-looking  anaerobic  sludge  remains 
on  the  bottom  of  the  channel  until  periodically  dredged. 

Studies  are  just  now  underway  to  adequately  evaluate  the  hazardous 
materials  discharged  into  the  Houston  Ship  Channel.  Pesticides,  pesticide 
manufacturing  residues,  heavy  metals  and  other  materials  are  known  to  be 
present. 

The  recent  case  involving  the  daily  discharge  of  cyanide  emphasizes 
the  toxic  material  problems. 

The  net  result  of  the  waste  materials  discharged  to  the  channel  Is 
demonstrated  by  the  list  of  fish  kills  compiled  by  a  Texas  A&M  University 
research  staff  member.  Low  dissolved  oxygen  in  combination  with  stress 
caused  by  toxic  ions  is  believed  to  be  the  predominant  cause  of  death. 
Reported  fish  kills  in  the  Houston  Ship  Channel  area  are  listed  in  Table  1. 

There  is  hope  for  the  future.  Galveston  Bay  Is  not  yet  a  dead  system, 
and  the  Houston  Ship  Channel  pollution  load  trend  has  been  reversed. 
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Federal  involvement,  expanded  state  capability  and  action,  expanded 
research  programs  and  public  concern  are  beginning  to  swing  the  pendulum 
to  a  more  proper  direction. 

The  Environmental  Engineering  Division  of  Texas  A&M  University's 
Civil  Engineering  Department  has  carried  out  a  vigorous  program  of  research 
relating  to  the  Houston  Ship  Channel.  Currently  a  staff  of  40  supported 
by  a  field  laboratory  and  a  well  equipped  three  vessel  research  fleet  is 
involved. 

This  research, coupled  with  those  of  companion  groups  and  effective 
state  and  federal  programs,  shows  promise  in  making  the  Houston  Ship  Channel- 
Gal  veston  Bay  System  an  acceptable  aquatic  environmental  system. 
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LOCATION  OF  DOMESTIC  AND  INDUSTRIAL  DISCHARGES  ON  THE 
HOUSTON  SHIP  CHANNEL 
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1.  HAS  BASE  FOR  MERCAPTANS 

2.  ETHYL,  METHYL,  BUTYL 

MERCAPTANS 


A'  / 


PRODUCTS: 

1.  DDT 

2.  CHLORAL 

3.  BENZENE 

4.  OTHER  INSIC, 
I  HERBICIDES 

“  5.  MURIATI.  I 


JEFFERSON 


REICHOLD 


■  M 


X PRODUCTS: 

L  FERTILIZER 
2.  FEED- GRADE  UREA 
FEED  FROM  PHILLIPS 
CHEMICAL  AMMONIA  PUNT 


PRODUCTS: 

L  ANHYDROUS 
AMMONIA 


PRODUCTS: 

l  AVIATION  GASOLINE  « 

2.  MOTOR  GASOLINE 

X  JET  FUEL  • 

4.  DIESEL  4  FUEL  OIL  . 

5.  SOLVENTS  I  PETROCHEMICAL 1 
SPECIALTIES 

4  SULFUR  BY  RECOVERY 

M 

CAPACITY  ■  72,000  BPO 


TURNINO  IAS  IN  ' 


MAYO  SHELL  ’ 


vasica 


PRODUCTS: 

L  PLIOFLEX  RUBBER  (22Q.OOOTONS/YR) 
l  "TAILOR-MADE" 

STYRENE- BUTADIENE 
RUBBERS 

X  ANTI-OZONANTS 


PRODUCTS: 

L  BUTENES 

2.  BUTADIENE  (TO  GOODYEAR) 

X  OTHER  OLEFINS 
4.  AVIATION  ALKYLATES 
TOTAL  BUTADIENE  C200.000TONS/YR) 


l  STYRENE  MONOMER 
2.  ETHYUNE 
RAW  MATERIALS: 

L  GASOLINE  FRACTIONS 


PRODUCTS: 

L  HIGH  OCTANE  GASOLINE 

2.  HEATING  4  DIESEL  OILS 

3.  TOLUENES.  MIXED  XYLENES, 
PARAXYIENE 

CAPACITY  •  130,000  BPD 


PRODUCTS: 
l  WOOD  PULP 

2.  PAPER  4  FOOD 
CONTAINER  STOCK  A 

BY-PROOUCTS: 

L  TALL  OIL 
l  HYDROGEN 

3.  TURPENTINE 

4.  CAUSTIC  SODA 


PRODUCTS: 

L  GASOLINE,  NAPTHAS,  HEATING  OILS 

2.  KEROSENE,  WAVY  FUELS,  LUBA.  OIL 

3.  PETROCHEMICALS:  BENZENE, 
XYLENES,  TOLUENE,  ALKYLATE 

MOST  PRODUCTS  TO  LOCAL  MARKETS 


CAPACITY  •  33,000  BPD 


ANTJ  WITH  Jl  «  mcm  WnOYttI) 
>  CMIMKM  4  MTtOUUM  MIMNO 
NIMMV  t  PA*IOUtO  MITAU 
AU  OtNH  MAMUMCTVIMO 


I  VIA*  a  I  alto 


TEXAS  ASPHALT  \ 
4  REF.  CO. - * 

OLINMATHIESON 


PRODUCTS: 

l  AMMONIUM  PHOSPHATE- 
SULFATE 

2.  ORDINARY  4TRIPIX 
SUPER  PHOSPHATE 

3.  SULFURIC  ACID  FOR 
ROCK  TREATMENT 

4.  SODIUM  SILICO  FLUORIDE 

5.  PHOSPHERIC  ACID  600 T/D) 

RAW  MATERIALS: 

L  PHOSPHATE  ROCK 
2.  SULFUR 
X  .SPENT ACID 
5  xlO®  TONS  OF  WASTE 
GYPSUM  ON  SITE 

•WORLD’S  LARGEST 
PELLETIZED  FERTILIZER 
PLANT 


numrsBtamffl. — 

PRODUCTS, 

L  AMMONIA 

L  METHYL  VINYL  PYRIDINE 
X  AMMONIUM  SULFATE 

4.  TRIPLE  SUPER  PHOSPHATE 
X  POLYETHYLENE  PLASTIC 

FIGURE  3 


JACINTO 

POR 


AT  IIIMINAHAOI 


PRODUCTS: 

L  TETRAETHYLLEAD 
2.  ANTIOXIDANTS 
X  ETHYL  CHLORIDE 

4.  SODIUM 

5.  CHLORINE 

6.  VINYL  CHLORIDE 

7.  PRIMARY  ALCOHOLS 

WORLD'S  LARGEST  Ta  PRODUCE 

PRODUCTS:  .  I 

1.  ACETYLENE  OIT  LB7YR) 

2.  VINYL  CHLORIDE  MONOMi 
B0Ox#LBIYR) 

X  PROCESS  Oj  *  Nj 

4.  ANHYDROUS  AMMONIA 
E360TJD) 

X  METHANOL 

RAW  MATERIALS: 

L  NATL  GAS 

juammk'1 

PRODUCTS: 

L  GASOLINES 
2.  NAPTHAS  4  OTHER 
SOLVENTS 

X  KEROSENE  4  FUEL  OILS 
4.  LUBE  4  HEATING  OILS 
X  AROMATICS  4  WAXES 
CAPACITY-  130.000  BPD 


HOUSTON  SHIP  CHANNEL  INDUSTRIAL  COMP 
IS  £> 


3R  MERCAPTANS 
YL,  BUTYL 
PTANS 


PRODUCTS: 

1.  DDT 

2.  CHLORAL 

3.  BENZENE  HEXACHLORIDE 

4.  OTHER  INSECTICIDES 
t HERBICIDES 

5.  MURIATIC  ACID 


PRODUCTS: 

1.  ANHYDROUS 
AMMONIA 


&•/§£ 


PRODUCTS: 

1.  COMBINATIONS  OF 
SYNTHETIC  RUBBER 
l  CARBON  BLACK 

2.  SYNTHETIC  LATEX 


STAUFFER  CHEM.  CO. 
PRODUCTS: 

1.  SULFURIC  ACID 


i4  JACINTO 


PORT 


:u 


HUMBLE  OIL  A  REF.  CO. 

PRODUCTS: 

L  GASOLINE  A  OILS 

2.  AROMATICS  A  SOLVENTS 

3.  BUTADIENE  A  BUTYL  RUBBER 

4.  PARAXYLENE,  POLY  PROPYLENE 
X  BASIC  ALCOHOLS,  OTHER 

OXYCHEMICALS 
6.  CYCLOHEXANE 

CAPACITY  •  300,000  BPD 


«T  TEIMINAL  IAIUOAD  ASSOCIATION 


Alauandar 
.  /•/. 


\\  V 


‘-ETHYL  CORP. 

PRODUCTS: 

1.  TETRAETHYLLEAD 

2.  ANTIOXIDANTS 

3.  ETHYL  CHLORIDE 

4.  SODIUM 

5.  CHLORINE 

6.  VINYL  CHLORIDE 

7.  PRIMARY  ALCOHOLS 

WORLD'S  LARGEST  Ta  PRODUCES 


PRODUCTS:  , 

1.  ACETYLENE  OO*  LB/YR) 

2.  VINYL  CHLORIDE  MONOMER 
(200  x  10^  LB/YR) 

3.  PROCESS  0?  AN, 

4.  ANHYDROUS  AM40NIA 
WOT/DI 

5.  METHANOL 
RAW  MATERIALS: 

1.  NATL  GAS 

SHELL  OIL  CO. - 

PRODUCTS: 

1.  GASOLINES 

2.  NAPTHAS  A  OTHER 
SOLVENTS 

3.  KEROSENE  A  FUa  OILS 

4.  LUBE  A  HEATING  OILS 

5.  AROMATICS  A  WAXES 
CAPACITY -  130.000  IPO 


PRODUCTS:  X, 

l  CHLORINE-CAUSTIC-H,  > 

2.  ETHYLENE  BICHLORIDE* 

3.  PERCHLORETHYLENE 

4.  GASEOUS  HCI 

5.  ACETYLENE 
A  AMMONIA 

VERY  LARGE  ELEC.  USER  - 

GEN.  SOM{  OF  MJR  OWN _ / - 

‘  Mill!  1 1 1 


I  JJ  Black 

)  ID  Duck 


j  t  Smn  lactntqJf** 


A  PRODUCTS: 

1.  N- BUTANE 

2.  PROPANE 

3.  NATL  GASOLINE 

4.  ISO-BUTANE 


DUPONT 

PRODUCTS: 

1.  UREA 

2.  METHYIAMINES 

r  3.  HERBICIDES  A  FUNGICIDES 


r,  v7?’  3-  HERBICIDE! 
'■*JrVS?S  5.  SOLVENTS 


GREIF  BROS. 


i BAYPORT 

i 

■RETZLOSE.  _ 

CHEM.  CORP.  7 
PRODUCTS:  / 

1.  METHYfPARTHIEN 

2.  OTHER  AGRICULTURAL 
CHMICALS 

FEED  IS  /ROMATICS  & 
FROM  HUM||iOIL 

\ _ .  ■ 


■am  am  a  X 

PRODUCTS:  nn 

LARGE  RANGE  OF  CHEMICALS  S 
USING  REFINERY  FQO  GASES  ' 
EXAMPUS: 

L  GLYCERINE 
2.  ETHYLENE 
X  ETHYL  ALCOHOL 

03 1  Ur  GAl/YRI  w 

4.  EPOXY  RESINS 
V  CHLORINE-CAUSTIC  If 


INDUSTIIAl 

.wash 

/COILKTWN 
f  UNIS 


wasti 

tmatmint 

lUNT  / 


UPJOHN  CO. 

PROOUCTS, 

L  POLYMERS 

PRODUCTS 
L  POLYETHYLENE 
GRANATES 

'TgfflMftf.llKi 

PRODUCTS: 

L  ALUMINIUM TRIALKYLS 
2.  OTHER  METALLIC  ALKYLS 


PROOUCTS: 

L  INTERMEDIATES  FOR 
INSECTICIDES.  PLASTICS. 
RESINS,  ETC. 

2.  ACETYLENE 
X  AMMONIA 
4.  METHANOL 
X  CUTYL  ACRYLATE 


USTRIAL  COMPLEX 


Nap  Court aay  of  X 


DURATION  CURVE— HOUSTON  SHIP  CHANNEL  ABOVE  SAN  JACINTO  RIVER 
—  EXCLUDING  WASTE  INFLOWS  TO  CHANNEL- 


POLLUTION 

INCIDENTS 


neuftc  5 


25( 


SUMMARY  OF  DISSOLVE!.  0*V3EN  { MG/L?  HO'J?TON  SHIP  CHANNEL 


MR.  VERNON  GROSE 


MR.  JEROME  SELMAN 


1S6 


PROF.  JOHN  MIHALASXY 


MR.  W.  PAUL  HENDERSON 


OR.  E.  H.  SICCAMA 
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NATIONAL  RESEARCH  COUNCIL 

NATIONAL  ACADEMY  OF  SCIENCES  NATIONAL  ACADEMY  OF  ENGINEERING 

1101  CONSTITUTION  AVENUE  WASHINGTON,  D.C.  *0<l8 


COMMITTEE  O  V  HAZARDOUS  MATERIALS 

ADVISORY  TO  THE  I1.#.  COAST  CUARD  TELEPHONE!  SOS  961  -1579 

DIVISION  or  CHEMISTRY  AND  CHEMICAL  TECHNOLOGY  July  1,  1971  CASLE  ADDRESS:  NARECO,  WASHINGTON,  U.  C. 

COMITTEE  ON  HAZARDOUS  MATERIALS 

In  response  to  a  letter  of  December  5,  1963  from  the  Commandant  of  the 
U.S. Coast  Guard  to  the  President  of  the  National  Academy  of  Sciences,  a  com¬ 
mittee  has  been  established  in  the  Division  of  Chemistry  and  Chemical  Tech¬ 
nology  with  the  following  purpose. 

The  NRC  Committee  on  Hazardous  Materials  is  a  committee  of  the  National 
Academy  of  Sciences  -  National  Research  Council  charged  to  advise  the  Coast 
Guard  on  scientific  and  technical  questions  relating  to  safe  maritime  trans¬ 
portation  of  hazardous  materials.  The  need  for  such  a  committee  has  been 
occasioned  by  the  rapid  growth  of  chemical  industry  during  recent  years, 
coupled  with  major  advances  in  shipping  technology.  A  wide  variety  of 
materials  that  are  combustible,  toxic,  or  chemically  reactive  are  now  being 
shipped  in  bulk  over  congested  waterways  and  additional  materials  are  in 
prospect.  The  methods  of  shipping  include  pressure  containers  (e.g.,  for 
compressed  gases) ,  cryogenic  containers  (for  liquefied  gases  including  LNG 
and  LPG),  and  heated  containers  (for  liquid  sulfur  and  liquid  asphalt),  as 
well  as  the  more  conventional  means.  The  function  of  the  committee  is  to 
visualize  the  problems  created  in  regard  to  safety  and  public  health,  and  to 
formulate  research  or  engineering  approaches  to  their  solution.  As  the  out¬ 
come  of  such  studies,  the  committee  will  make  recommendations  that  the  Coast 
Guard  can  consider  in  discharging  its  own  regulatory  responsibilities. 

Membership  of  the  committee  for  Fiscal  Year  1971-1972: 

Donald  L.  Katz,  Chairman 
University  of  Michigan 

Robert  B.  Beckmann 
University  of  Maryland 

David  Burgess 
Bureau  of  Mines 

Homer  W.  Carhart 
Naval  Research  Laboratory 

W.  A.  Cunningham 
University  of  Texas 

W.  Doyle 

Factory  Insurance  Assoc. 


Roy  W.  Hann 

Texas  A$M  University 

B.  L.  Harris 

Edgewood  Arsenal,  Maryland 
Clyde  McKinley 

Air  Products  and  Chemicals,  Inc. 

W.  E.  McConnaughey 

Liaison  with  the  U.  S.  Coast  Guard 

Howard  H.  Fawcett,  Technical  Secretary 
NAS-NRC 
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SENIOR  ADVISORY  PANEL 


The  Committee  on  Hazardous  Materials  has  enjoyed  association 
with  several  members  who  have  served  with  distinction.  Each  has 
made  significant  contributions  to  the  understanding  of  the  technical 
aspects  of  hazardous  materials  in  bulk  water  transportation,  gener¬ 
ating  and  developing  concepts  which  are  useful  to  the  U.  S.  Coast 
Guard.  It  would  be  unfortunate  if  these  distinguished  Committee 
members  completely  severed  their  relationship  with  Committee 
Activities  upon  completing  a  tour  of  service. 

Therefore,  a  Senior  Advisory  Panel  has  been  established  to 
recognize  contributions  of  these  individuals,  and  to  provide  a 
mechanism  for  continued  limited  service.  By  this  assignment,  the 
Committee  will  retain  a  valued  resource  in  expertise  and  experience. 

Several  persons,  who  have  not  taken  part  in  the  full  deliberations 
of  the  Committee  membership,  nevertheless  have  made  outstanding  con¬ 
tributions  to  the  various  panel  studies.  Me  feel  *t  is  fitting  and 
proper  that  their  distinguished  service  also  be  recognized.  Accord¬ 
ingly,  these  individuals  are  invited  to  membership  on  the  Senior 
Advisory  Panel. 

Membership  on  the  Panel  is  normally  for  a  period  of  three 
years,  subject  to  reappointment  with  mutual  continued  interest 
and  service. 

Panel  members  appointed  July  1,  1970: 

♦Dr.  Glenn  H.  Damon 
•Prof.  C.  Sliepcevich 
•Miles  E.  Woodworth 
Prof.  James  Brown 
Prof.  Adrian  Gaufin 
Dr.  R.  H.  Van  Dolah 

Panel  members  appointed  July  1,  1971: 

••Edgar  M.  Adams 
**Dt.  W.  W.  Crouch 
•••Dr.  Joseph  H.  Padon 


*  Committee  Member  1964-1970 
••Committee  Member  1964-1971 
•••Committee  Member  1965-1971 
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Edgewood  Arsenal,  Md.  21010 

Hawkins,  Harold 
PHillips  Petroleum  Co. 

Bartlesville,  Oklahoma  74004 

Henderson,  W.  Paul 
Chief,  Engineering  Test  and 
Evaluation  Section 
Department  of  the  Army 

Edgewood  Arsenal 
Edgewood,  Maryland 


Conference  Participants 


Katz,  Prof.  Donald  L. 

Department  of  Chemical  Engineering 
East  Engineering  Bldg.,  Room  2042 
University  of  Michigan 
Ann  Arbor,  Michigan  48104 

Lakey,  Robert  J. 

U.  S.  Coast  Guard  Headquarters 
Room  8309A 

400  -  7th  Street,  S.  W. 

Washington,  D.  C.  20S90 

Lindak,  Lt.  John  E.,  USCG 
U.  S.  Coast  Guard  Headquarters 
Room  6201H 

400  -  7th  Street,  S.  W. 

Washington,  D.  C.  20590 

Lyden,  Michael  E. 

Staff  Engineer 

The  Chlorine  Institute,  Inc. 

342  Madison  Avenue 
New  York,  N.  Y.  10017 

McConnaughey,  William  E. 

Technical  Advisor 
U.  S.  Coast  Guard  Headquarters 
400  -  7th  Street,  S.  W.  Room  8308 
Washington,  D.  C.  20590 

McKinley,  Dr.  Clyde 
Director,  Research  8  Development 
Air  Products  8  Chemicals,  Inc. 
Allentown,  Penn.  18105 

Mcleaisch,  Cdr.  J.  I.,  USCG 
Marine  Inspection  Office 
Room  201 ,  Customhouse 
Galveston,  Texas  77550 

Mihalasky,  Prof.  John 
Asst.  Chairman,  Graduate  Courses 
Industry  8  Management  Engineering  Dept. 
Newark  College  of  Engineering 
Newark,  New  Jersey  07102 

Muery ,  Sam  J. ,  Jr. 

Mgr.  Shipping  and  Quality  Control 
Freeport  Sulphur  Co. 

P.  0.  Box  61520 
New  Orleans,  La.  70160 


Newcomer,  Gordon  M. 

Safety  Officer 

National  Aeronautics  and  Space  Admin. 
Washington,  D.  C.  20546 

Oren,  Adm,  J.  B.  USCG,  RET 
Maritime  Transportation  Research  Board 
National  Research  Council 
Washington,  D.  C.  20418 

Phillips,  R.  C. 

The  Travelers  Insurance  Co. 

One  Tower  Square 
Hartford,  Conn.  06115 

Pylant,  Hugh 
Bureau  Chief 
Chemical  Week 
2270  Humble  Bldg. 

Houston,  Texas  77002 

Reider,  Roy 
Safety  Director 

Los  Alamos  Scientific  Laboratory 
Los  Alamos,  New  Mexico  87544 

Ross,  Rex 

Bonner  8  Moore  Assoc.,  Inc. 

500  Jefferson  Bldg. 

Cullen  Center 
Houston,  Texas  77002 

Sandelin,  Fallehey 
Chairman, 

Channel  Industries  Mutual  Aid 
Atlantic  Richfield  Co. 

Houston,  Texas  77001 

Sawyer,  Cdr.  R.  E.,  USCG 
Officer-in-Charge 
Marine  Inspection 
2010  North  12th  Street 
St.  Louis,  Missouri  63101 

Selman,  Jerome 
Operations  Research  Group 
U.  S.  Army  Munitions  Command 
Code  AMSMU-ORSA 
Dover,  New  Jersey  07801 


Conference  Participants 

Siccama,  Dr.  E.  H. 

Office  of  Directeur-Generaal  van 
de  Arbeid 
Postbus  3069 

Voorburg,  The  Netherlands 

Sliepcevich,  Prof.  Cedomir  M. , 

Flame  Dynamics  Laboratory 
1215  Westheimer  Drive 
Norman,  Oklahoma  73069 

Staffa,  C.  J. 

Texas  Gulf  Sulphur  Co. 

Houston,  Texas  77001 

Stanek,  Wencil 
Southern  Railroad 
P.  0.  Box  1808 
Washington,  D.  C.  20013 

Starr,  Dr.  Chauncey 

Dean,  School  of  Eng.  8  Applied  Science 

University  of  California 

Los  Angeles,  Calif.  90024 

Vierbicher,  J.  A. 

Manager,  Marine  Department 
Shell  Oil  Co. 

One  Shell  Plaza 
Houston,  Texas  77002 

Wallace,  Capt.  S.  A.,  USCG 
Chief, 

Marine  Environmental  Protection  Div. 
Headquarters  USCG  (WEP/73) 

400  -  7th  Street  S.  W. 

Washington,  D.  C.  20591 

Waring,  Capt.  C.  H. 

Mgr. ,  Accident  Prevention  Division' 
Lykes  Bros.,  Steamship  Co.,  Inc. 
Hibernia  Bank  Building 
New  Orleans,  Louisiana  70150 

Welker,  Dr.  J.  Reed 
Flame  Dynamics  Laboratory 
1215  Westheimer  Drive 
Norman,  Oklahoma  73069 

West,  Capt.  W.  E.,  USCG 
Commanding  Offier 
Captain  of  the  Port  Office 
Houston,  P.  0.  Box  446 
Galena  Park,  Texas  77S47 


Page  4 

Wybenga,  LTJG  F. „  USCG 
Marine  Inspection  Office 
7300  Wingate  Street 
Houston,  Texas  77011 

Woodworth,  Miles  E. 

National  Fire  Protection  Assoc. 

60  Batterymarch  Street 
Boston,  Mass.  02110 

Zaker,  Dr.  T.  A. 

Chief  Explosives  Scientist 
Armed  Services  Explosives  Safety  Board 
Department  of  Defense 
Washington,  D.  C.  20315 


